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Why GAO Did This Study 

The Defense Contract Audit 
Agency (DCAA) under the 
Department of Defense (DOD) 
Comptroller plays a critical role in 
contractor oversight by providing 
auditing, accounting, and financial 
advisory services in connection 
with DOD and other federal agency 
contracts and subcontracts. 
Last year, GAO found numerous 
problems with DCAA audit quality 
at three locations in California, 
including the failure to meet 
professional auditing standards. 
This report addresses audit quality 
issues at DCAA offices nationwide. 
GAO was asked to (1) conduct a 
broad assessment of DCAA's 
management environment and 
audit quality assurance structure, 
(2) evaluate DCAA actions to date 
to correct previously identified 
problems, and (3) identify potential 
legislative and other actions for 
improving DCAA effectiveness and 
independence. To achieve these 
objectives, GAO analyzed DCAA's 
mission, strategic plan, audit 
policies, and quality assurance 
program; conducted interviews; 
reviewed selected audits at DCAA 
offices; and analyzed legislative 
and other actions. 
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to DOD and the DOD Inspector 
General (IG) to improve DCAA's 
management environment, audit 
quality, and oversight. GAO also 
discusses matters that Congress 
should consider to enhance the 
effectiveness and independence of 
DCAA contract audits. DOD and 
DOD IG generally agreed with 
GAO's recommendations, 
concurring with all but two. 
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What GAO Found 

GAO found audit quality problems at DCAA offices nationwide, including 
compromise of auditor independence, insufficient audit testing, and 
inadequate planning and supervision. GAO's conclusions stem from a review 
of 69 audit assignments supporting contract award and administrative 
decisions; an assessment of DCAA's audit quality assurance structure, which 
found similar audit quality problems but gave satisfactory ratings to deficient 
audits; and DCAA's rescission of 80 problem audit reports. The rescinded 
audits supported decisions on pricing and contract awards and impacted the 
planning and reliability of hundreds of other DCAA audits, representing 
billions of dollars in DOD expenditures. GAO findings include the following. 

Selected Details of Audits GAO Reviewed 
Contractor Audit Significant case study issues 

Research and Billing • DCAA auditors spent 530 hours to support an audit of a 
development system nonexistent billing system and reported adequate system controls, 

grantee . Instead, DCAA should have relied on the Single Audit Act report on 

the grantee's cash management system. DCAA agrees. 

Combat Billing • This was a new system and therefore high risk, but auditors 

systems system deleted key audit steps related to contractor policies and internal 

controls over progress payments without explanation. 

• One auditor told GAO he did not perform detailed tests because 
"the contractor would not appreciate it." 

• DCAA allowed the contractor 7 months to address 6 significant 
deficiencies, dropping 2 and downgrading the other 4. 

« DCAA rescinded this audit report following GAO's review. 

Iraq Accounting • Contractor objected to draft report, which included 8 significant 

reconstruction system deficiencies in the accounting system. 

• Auditors dropped 5 significant deficiencies and downgraded 3 
others to suggestions to improve without performing new work. 

• Supervisory auditors directed audit staff to delete some audit 
documents, generate others, and in one case, copy the signature 
of a prior supervisor onto new documents making it appear that the 
prior supervisor had approved a revised risk assessment. 

• Supervisory auditor who approved altered documents was later 
promoted to western region quality assurance manager, where he 
served as quality control check over thousands of audits. 

Source: GAO. 

GAO found DCAA's management environment and quality assurance structure 
were based on a production-oriented mission that put DCAA in the role of 
facilitating DOD contracting without also protecting the public interest. DCAA 
has taken several positive steps. However, DOD and DCAA have not yet 
addressed fundamental weaknesses in DCAA's mission, strategic plan, 
metrics, audit approach, and human capital practices that had a detrimental 
effect on audit quality. 

To improve DCAA oversight, the DOD Comptroller requested Defense 
Business Board and "tiger team" reviews and established a DCAA Oversight 
Committee. In addition, in the short-term, Congress could provide DCAA with 
certain legislative protections and authorities similar to those available to IGs. 
In the longer term, Congress may wish to consider organizational changes to 
elevate DCAA to a component agency reporting to the Deputy Secretary or to 
establish an independent governmentwide contract audit agency. 
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United States Government Accountability Office 
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September 23, 2009 

The Honorable Joseph I. Lieberman 
Chairman 

The Honorable Susan M. Collins 
Ranking Member 

Committee on Homeland Security and 
Governmental Affairs 
United States Senate 

The Honorable Claire C. McCaskill 
Chairman 

Subcommittee on Contracting Oversight 
Committee on Homeland Security and 
Governmental Affairs 
United States Senate 

This report addresses audit quality problems and independence issues at 
the Defense Contract Audit Agency (DCAA). In a September 2008 hearing 
before the Committee, we testified 1 that DCAA failed to meet professional 
audit standards at three locations in California. Specifically, we found that 
the audit documentation for 14 selected audits at two locations did not 
support reported opinions, that DCAA supervisors dropped findings and 
changed audit opinions without adequate audit evidence for their changes, 
and that sufficient audit work was not performed to support audit 
opinions and conclusions. Further, we found that contractor officials and 
the Department of Defense (DOD) contracting community improperly 
influenced the audit scope, conclusions, and opinions of several audits, 
including forward pricing audits at a third location — a serious 
independence issue. During our investigation, DCAA managers took 
actions against their staff at two locations that served to intimidate 
auditors and create an abusive work environment. For example, we 
learned of verbal admonishments, reassignments, and threats of 
disciplinary action against auditors who spoke with or contacted our 
investigators, DOD investigators, or DOD contracting officials. 



1 GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 
Professional Standards Were Substantiated, GAO-08-993T (Washington, D.C.: Sept. 10, 
2008). 
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At the time of the September 2008 hearing, we were conducting a broad 
assessment of DCAA's management environment and audit quality 
assurance structure at DCAA offices nationwide. Given the evidence 
presented at this hearing, you requested that we expand our ongoing 
assessment. This report therefore presents (1) an assessment of DCAA's 
management environment and quality assurance structure; (2) an analysis 
of DCAA's corrective actions in response to our July 2008 report, 2 the 
Under Secretary of Defense (Comptroller/Chief Financial Officer) 3 "tiger 
team" review, 4 and the Defense Business Board study; 5 and (3) potential 
legislative and other actions that could improve DCAA's effectiveness and 
independence. 

To assess DCAA's overall management environment and quality assurance 
structure, we analyzed DCAA's mission statement and strategic plan, 
performance metrics, policies and audit guidance, and system of quality 
control. We also reviewed audit documentation for selected audits at 
certain field audit offices (FAO) in each of DCAA's five regions for 
compliance with generally accepted government auditing standards 
(GAGAS) 6 and other applicable standards. We selected 37 audits of 
contractor internal control systems performed by seven geographically 
disperse DCAA field offices within the five DCAA regions during fiscal 
years 2004 through 2006. 7 These were the most recently completed fiscal 
years at the time we initiated our audit. Our approach focused on DCAA 
offices that reported predominately adequate, or "clean," opinions on 
audits of contractor internal controls over cost accounting, billing, and 



2 GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 
Professional Standards Were Substantiated, GAO-08-857 (Washington, D.C.: July 22, 2008). 

3 Hereafter referred to as the DOD Comptroller/CFO. 

4 Under Secretary of Defense — Comptroller, Memorandum for Director Defense Contract 
Audit Agency, Subject: Implementation of Corrective Actions, (Washington, D.C.: Aug. 20, 
2008). 

5 Defense Business Board, Report to the Secretary of Defense: Independent Review Panel 
Report on the Defense Contract Audit Agency, October 2008. 

6 GAO, Generally Accepted Government Auditing Standards, GAO-03-673G (Washington, 
D.C.: June 2003) and GAO-07-731G (Washington, D.C.: July 2007). 

7 In the case of follow-up audits, we also reviewed the documentation for the previous audit 
to gain an understanding of the scope of work and deficiencies identified in the prior audit. 
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cost estimating systems issued in fiscal years 2005 and 2006. 8 We selected 
DCAA offices that report predominately adequate opinions on contractor 
systems and related internal controls because contracting officers rely on 
these opinions for three or more years to make decisions on pricing and 
contract awards, and payment. For example, audits of estimating system 
controls support negotiation of fair and reasonable prices. 9 Also, the FAR 
requires contractors to have an adequate accounting system prior to award 
of a cost-reimbursable or other flexibly priced contract. 10 Billing system 
internal control audit results support decisions to authorize contractors to 
submit invoices directly to DOD and other federal agency disbursing 
offices for payment without government review. 11 In addition, DCAA uses 
the results of internal control audits to assess risk and plan the nature, 
extent, and timing of tests for other contractor audits and other 
assignments. When a contractor has received an adequate opinion on its 
systems and related controls, DCAA would assess the risk for subsequent 
internal control and cost-related audits as low and would perform less 
testing on these audits. Although our selection of the seven offices and 37 
internal control audits was not statistical, it represented about 9 percent of 
the total 76 DCAA offices that issued audit reports on contractor internal 
controls and nearly 18 percent of the 40 offices that issued 8 or more 
reports on contractor internal controls during fiscal year 2006. Of the 37 
internal control audits we reviewed, 32 reports were issued with adequate 
opinions and 5 reports were issued with inadequate-in-part opinions. 

At the same seven DCAA field offices, we selected an additional 32 paid 
voucher, overpayment, request for equitable adjustment, and incurred cost 
assignments that were completed during fiscal years 2004 through 2006 for 
review of supporting documentation to determine whether DCAA auditors 
were identifying and reporting contractor overpayments and billing 



In selecting the seven DCAA offices, we considered a 2-year history of internal control 
audit results. The seven DCAA offices we selected reported adequate opinions on 89 
percent or more of the internal control reports they issued during fiscal year 2006. During 
fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the 
internal control reports they issued, and the other 3 offices issued adequate opinions in 50 
to 69 percent of the internal control audit reports they issued. 

9 DCAA, Contract Audit Manual (CAM) 5-1202. la and Defense Federal Acquisition 
Regulation Supplement (DFARS) 215.407-5. 

10 FAR §§ 16.104(h) and 16.301-3(a)(l). 

11 FAR § 42.101 and DFARS § 242.803. 
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errors. 12 In total, we reviewed 69 DCAA audits and cost-related 
assignments. 13 To address our second objective, we assessed the status 
and analyzed several key actions that DCAA initiated as a result of our 
earlier investigation, including changes in performance metrics and policy 
and procedural guidance, as well as DCAA efforts in response to DOD 
Comptroller/CFO and Defense Business Board 14 recommendations. To 
achieve our third objective to identify potential legislative and other 
actions that could improve DCAA's effectiveness and independence, we 
considered DCAA's current role and responsibilities; the framework of 
statutory authority for auditor independence in the Inspector General Act 
of 1978, as amended; 15 best practices of leading organizations that have 
made cultural and organizational transformations; our past work on DCAA 
organizational alternatives; GAGAS criteria for auditor integrity, 
objectivity, and independence; and GAO's Standards for Internal Control 
In the Federal Government 16 on managerial leadership and oversight. 

Throughout our audit, we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and DCAA 
region and FAO managers, supervisors, and auditors. We also met with 
DOD Office of Inspector General (OIG) auditors responsible for DCAA 
audit oversight and DOD OIG hotline office staff. We conducted this 
performance audit from August 2006 through December 2007, at which 
time we suspended this work to complete our investigation of hotline 
complaints regarding audits performed at three DCAA field offices. We 
resumed our work on this audit in October 2008 and performed additional 



12 Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate payments and payments in excess of amounts billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billing for unallowable cost. Recoveries of 
overpayments can be accomplished through refunds, subsequent billing offsets, or other 
adjustments to correct billing errors. 

13 Although we selected 73 assignments for review, two internal control assignments were 
assist audits and two cost related assignments were not completed assignments. As a 
result, we did not consider these four assignments in our analysis, and we discuss the 
results of our analysis of the 69 completed assignments that we reviewed. 

14 On August 19, 2008, at the request of the DOD Defense, Comptroller, the Deputy 
Secretary of Defense established an independent review panel under the Defense Business 
Board (DBB) to review DCAA operations and make recommendations for improvements. 

15 Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

16 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: November 1999). 
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work through mid-September 2009 to evaluate DCAA's quality assurance 
program during fiscal years 2007 and 2008, assess DCAA corrective actions 
on identified audit quality weaknesses, and consider legislative and 
organizational placement options. During our assessment of DCAA 
corrective actions and analysis of legislative and organizational placement 
options for DCAA, we met with the former DOD Comptroller/CFO to 
discuss plans for Office of Comptroller/CFO and Defense Business Board 
reviews, and we continued to meet with and obtain information from the 
new DOD Comptroller/CFO and his staff. We also met with Comptroller's 
new DCAA Oversight Committee, which includes the Auditors General of 
the Army, the Navy, and the Air Force; the DOD Director of Defense 
Procurement and Acquisition Policy; and the DOD Deputy General 
Counsel for Acquisition. We obtained DOD and DOD OIG comments on a 
draft of this report. DOD and DOD IG comments are summarized in the 
Agency Comments and Our Evaluation section of this report. DOD 
comments are reprinted in appendix IV and DOD OIG comments are 
reprinted in appendix V. We conducted our audit in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for findings and conclusions based on our 
audit objectives. We performed our investigative procedures in 
accordance with quality standards set forth by the Council of the 
Inspectors General on Integrity and Efficiency (formerly the President's 
Council on Integrity and Efficiency). A detailed discussion of our 
objectives, scope, and methodology is included in appendix III. 



DOD contract management continues to be a high-risk area for the 
government. 17 With hundreds of billions of taxpayer dollars at stake, 
strong controls are needed to provide reasonable assurance that contract 
funds are not lost to fraud, waste, abuse, and mismanagement. Downsizing 
of contract administration personnel during the 1990s coupled with 
increased contract spending since 2000 have exacerbated the risks 
associated with DOD contract management. Our work continues to 



Background 



17 GAO, High-Risk Series: An Update, GAO-09-271 (Washington, D.C.: January 2009). 
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identify significant problems with federal agency contract payments 18 and 
contract management. 19 

DCAA is charged with a critical role in DOD contractor oversight by 
providing auditing, accounting, and financial advisory services in 
connection with the negotiation, administration, and settlement of 
contracts and subcontracts. DCAA also performs contract audit services 
and payment reviews for other federal agencies, as requested, on a fee-for- 
service basis. DCAA contract audit services are intended to be a key 
control to help assure that prices paid by the government for needed 
goods and services are fair and reasonable and that contractors are 
charging the government in accordance with applicable laws, regulations 
(e.g., Federal Acquisition Regulation (FAR) and Defense Federal 
Acquisition Supplement (DFARS), standards (e.g., Cost Accounting 
Standards (CAS)), and contract terms. 

DCAA is headed by a director who reports to the Under Secretary of 
Defense (Comptroller/CFO). DCAA's placement provides the DOD 
Comptroller/CFO with access to financial information on defense 
contracts and allows the Comptroller/CFO to make this information 
available to the Secretary and Deputy Secretary of Defense. In addition, it 
permits the Comptroller/CFO to elevate policy issues concerning the 
scope of DCAA's authority and level of resources. The DCAA Director is 



GAO, Global War on Terrorism: DOD Needs to More Accurately Capture and Report the 
Costs of Operation Iraqi Freedom and Operation Enduring Freedom, GAO-09-302 
(Washington, D.C.: Mar. 17, 2009); Centers for Medicare and Medicaid Services: Internal 
Control Deficiencies Resulted in Millions of Dollars of Questionable Contract Payments, 
GAO-08-54 (Washington, D.C.: Nov. 15, 2007); Defense Contract Management: DOD's Lack 
of Adherence to Key Contracting Principles on Iraq Oil Contract Put Government 
Interests at Risk, GAO-07-839 (Washington, D.C.: July 31, 2007); Hanford Waste Treatment 
Plant: Department of Energy Needs to Strengthen Controls over Contractor Payments 
and Project Assets, GAO-07-888 (Washington, D.C.: July 20,2007); Iraq Contract Costs: 
DOD Consideration of Defense Contract Audit Agency's Findings, GAO 06-1132 
(Washington, D.C. Sept. 25, 2006); Department of Energy, Office of Worker Advocacy: 
Deficient Controls Led to Millions of Dollars in Improper and Questionable Payments to 
Contractors, GAO-06-547 (Washington, D.C.: May 31, 2006); and Federal Bureau of 
Investigation: Weak Controls over Trilogy Project Led to Payment of Questionable 
Contractor Costs and Missing Assets, GAO-06-306 (Washington, D.C: Feb. 28, 2006). 

19 GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, GAO-09-326SP 
(Washington, D.C: Mar. 30, 2009); Defense Management: Actions Needed to Overcome 
Long-standing Challenges with Weapon Systems Acquisition and Service Contract 
Management, GAO-09-362T (Washington, D.C: Feb. 11, 2009); and Defense Acquisitions: 
DOD's Increased Reliance on Service Contractors Exacerbates Long-standing Challenges, 
GAO-08-621T (Washington, D.C: Jan. 23, 2008). 
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responsible for day-to-day management of DCAA, development of strategic 
plans, audit guidance and procedures, and the quality of DCAA's audit 
services. DCAA's Contract Audit Manual (CAM) 20 prescribes the 
standards, policies, and techniques to be followed by DCAA personnel in 
conducting contract audits. DCAA emphasizes and supplements CAM 
guidance through policy memorandums and other written notices, as well 
as through training and oral communications. 

The IG Act gives the DOD IG broad responsibilities to provide policy 
direction for and to conduct, supervise, and coordinate audits and 
investigations in DOD and in contractor operations, if warranted. DOD IG 
duties pertaining to DCAA include (1) providing policy direction for all 
DOD audits; (2) investigating fraud, waste, and abuse uncovered as a 
result of audits; (3) monitoring and evaluating adherence by all DOD 
auditors to audit policies, procedures, and standards; and (4) requesting 
assistance as needed from other auditors in DOD. As part of its audit 
policy and oversight responsibilities, the DOD IG reviews DCAA's system 
of audit quality control on a 3-year basis that is intended to meet the 
requirements under GAGAS for a peer review. 



DCAA History and Audits of military contracts can be traced back to at least the World War I 

Organizational Structure era - Initially, the various branches of the military had their own contract 

audit function and associated instructions and accounting rulings. 
Contractors and government personnel recognized the need for 
consistency in both contract administration and audit. The Navy and the 
Army Air Corps made the first attempt to perform joint audits in 1939. By 
December 1942, the Navy, the Army Air Corps, and the Ordnance 
Department had established audit coordination committees for selected 
areas where plants were producing different items under contracts for 
more than one service. On June 18, 1952, the three military services jointly 
issued a contract audit manual that later became the DCAA CAM. 

In May 1962, Secretary of Defense Robert S. McNamara instituted "Project 
60" to examine the feasibility of centrally managing the field activities 



DCAA, Contract Audit Manual (CAM), DCAAM 7640.1. 
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concerned with contract administration and audit. 21 An outcome of this 
study was the decision to establish a single contract audit capability within 
DOD and DCAA was established on June 8, 1965. 22 At that time, DCAA's 
mission to perform all necessary contract audits for DOD and provide 
accounting and financial advisory services regarding contracts and 
subcontracts to all DOD components responsible for procurement and 
contract administration was established. The former Deputy Comptroller 
of the Air Force was selected as the DCAA Director and the former 
Director of Contract Audit for the Navy, was selected as the Deputy 
Director. DCAA was placed under management control of the Under 
Secretary of Defense (Comptroller), where it remains today. 

DCAA consists of a headquarters office at Fort Belvoir, Virginia, and six 
major organizational components — a field detachment office, which 
handles audits of classified contracting activity, and five regional offices 
within the United States. The regional offices manage field audit offices 
(FAO), which are identified as branch offices, resident offices, or 
suboffices. Resident offices are located at larger contractor facilities in 
order to facilitate DCAA audit work. In addition, regional office directors 
can establish suboffices as extensions of FAOs to provide contract audit 
services more economically. A suboffice depends on its parent FAO for 
release of audit reports and other administrative support. In total, there 
are more than 300 FAOs and suboffices throughout the United States and 
overseas. During fiscal year 2008, DCAA employed about 3,600 auditors at 
more than 300 FAOs throughout the United States, Europe, the Middle 
East, and in the Pacific to perform audits and provide nonaudit services in 
support of contract negotiations related to approximately 10,000 
contractors. 



DCAA Audit and Nonaudit DCAA's mission encompasses both audit and nonaudit services in support 
Services °f DOD contracting and contract payment functions. FAR subpart 42.1, 

"Contract Audit Services," and DOD Directive 5105.36, Defense Contract 



Project 60 also resulted in consolidation of the military services' contract management 
activities under the Defense Contract Management Agency (DCMA), formerly the Defense 
Contract Management Command (DCMC) within the Defense Logistics Agency. On March 
27, 2000, DCMC was established as DCMA under the authority of the Under Secretary of 
Defense (Acquisition, Technology, and Logistics). 

22 DOD, General Plan: Consolidation of Department of Defense Contract Audit Activities 
into the Defense Contract Audit Agency (Feb. 17, 1965). 
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Audit Agency (DCAA), establish DCAA as the department's contract audit 
agency 23 and set forth DCAA's responsibilities. 

FAR 42.101 prescribes contract audit responsibilities as submitting 
information and advice to the requesting activity, based on the analysis of 
contractor financial and accounting records or other related data as to the 
acceptability of the contractors' incurred and estimated costs; reviewing 
the financial and accounting aspects of contractor cost control systems; 
and, performing other analyses and reviews that require access to 
contractor financial and accounting records supporting proposed and 
incurred costs. DOD Directive 5150.36 lists several responsibilities and 
functions that shall be performed by the DCAA Director, 24 including: 

• "Assist in achieving the objective of prudent contracting by providing 
DOD officials responsible for procurement and contract 
administration 25 with financial information and advice on proposed or 
existing contracts and contractors, as appropriate." 

• "Audit, examine, and/or review contractors' and subcontractors' 
accounts, records, documents, and other evidence; systems of internal 
control; [and] accounting, costing, and general business practices and 
procedures; to the extent and in whatever manner is considered 
necessary to permit proper performance of other functions . . .." These 
other functions cover contract audit and nonaudit services. In addition, 
the Directive states that the DCAA Director shall perform such other 
functions as may be assigned by the Secretary and Deputy Secretary of 
Defense or the Under Secretary of Defense (Comptroller/CFO). 

• "Approve, suspend, or disapprove costs on reimbursement vouchers 
received directly from contractors, under cost-type contracts, 
transmitting the vouchers to the cognizant Disbursing Officer." 

DCAA uses the term audit to refer to a variety of evaluations of various 
types of data. 26 In fiscal year 2008, DCAA reported that over 97 percent of 
its service work hours were spent on audits, meaning that DCAA has opted 
to provide nearly all of its services to the contracting and finance 



DODD 5105.36, paragraph 4.2, reissued on February 28, 2002. 
DODD 5105.36, paragraphs 5.1 through 5.14. 

Contract administration responsibilities are set forth in FAR Subparts 42.2 and 42.3. 
CAM 2-001. 
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communities under applicable auditing standards, as discussed below. 
Table 1 lists several audit and nonaudit services provided by DCAA during 
the three phases of the contracting process — pre-award, contract 
administration, and close-out — and cites the statutory and regulatory 
provisions that authorize or establish the need to have DCAA perform the 
service. DCAA audits also support the contract payment process both 
directly and indirectly. For example, audits of contractor incurred cost 
claims and voucher reviews directly support the contract payment process 
by providing the information necessary to certify payment of claimed 
costs. 27 Other audits of contractor systems, including audits of contractor 
internal controls, CAS compliance, and defective pricing, indirectly 
support the payment process by providing assurance about contractor 
controls over cost accounting, cost estimating, purchases, and billings that 
the agency may rely upon when making contract decisions, such as 
determinations of reasonable and fair prices on negotiated contracts. For 
example, an accounting system deemed to be adequate by a DCAA audit 
permits progress payments based on costs to be made without further 
audit. 28 



Table 1 : Examples of DCAA Audit and Nonaudit Services 









Payment support 


Contract phase and 
assignment 


Audit and Nonaudit services 


Contracting 
support 


Direct Indirect 


Pre-award phase: 


Accounting system 3 


Audit: DCAA determines adequacy of the contractor's accounting 
system prior to award of a cost-reimbursable or other flexibly 
priced contract. FAR § 16.301-3(a)(l). 


X 


X 


Contractor accounting 
disclosure statements 


Audit: DCAA reviews the contractor's Disclosure Statement for 
adequacy and CAS compliance and determines whether the 
contractor's Disclosure Statement is current, accurate, and 
complete. DCAA also reviews Disclosure Statements during the 
post award phase if contractors revise them. FAR §§ 30.202-6(c), 
30.202-7 and 30.601(c). 


X 


X 


Estimating system a 


Audit: DCAA determines adequacy of contractor estimating 
systems. FAR § 15.407-5 and DFARS § 252.215-7002(d), (e). 


X 


X 



27 Disbursing officers are authorized to make payments on the authority of a voucher 
certified by an authorized certifying officer, who is responsible for the legality, accuracy, 
and propriety of the payment. 31 U.S.C. §§ 3325, 3521(a), and 3528(a). 

28 FAR § 32.503-4. 



Page 10 



GAO-09-468 DCAA Audit Environment 







Payment support 


Contract phase and 


Contracting 




assignment Audit and Nonaudit services 


support 


Direct Indirect 



Contract price Audit: DCAA examines contractor records to ensure that cost or X X 

proposals and forward pricing data is accurate, current, and complete and supports the 
pricing proposals" determination of fair and reasonable prices. 10 U.S.C. §§ 2306a 
and 2313 (DOD) and 41 U.S.C. § 254d (other agencies); FAR 
Subpart 15.4 (esp. FAR § 15.404-2(c)) and § 52.215-2(c); and 
DFARS § 215.404-1. 

Nonaudit: DCAA Director establishes and maintains liaison X X 

auditors and financial advisors, as appropriate, at major procuring 
and contract administration offices. These services are also 
provided during the post-award phase, as needed. DODD 
5105.36, paras. 7.1.1 and 5.9. 



Post award/administration phase: 


Internal control system Audit: DCAA reviews the financial and accounting aspects of the 
audits (generally) contractor's cost control systems, including the contractor's 

internal control systems. FAR § 42.101(a)(3) and DFARS § 

242.7501. 


X 




X 


Billing system audits 3 


Audit: DCAA determines adequacy of contractors' billing system 
controls and reviews accuracy of paid vouchers. DCAA uses audit 
results to support approval of contractors to participate in the 
direct-bill program. FAR § 42.101 and DFARS § 42.803 (b)(i)(C). 


X 


X 




Purchasing system 
review b 


Audit: DCAA determines adequacy of a contractor's or 
subcontractor's purchasing system. FAR Subpart 44.3. 


X 




X 


Progress payments" 


Audit: DCAA verifies amount claimed, determines allowability of 
contractor requests for cost-based progress payments, and 
determines if the payment will result in undue financial risk to the 
government. FAR §§ 32.503-3, 32.503-4, and 52.232-16. 


X 


X 




Incurred cost claims 3 


Audit: DCAA determines acceptability of the contractors' claimed 
costs incurred and submitted by contractors for reimbursement 
under cost-reimbursable, fixed-price incentive, and other types of 
flexibly priced contracts and compliance with contract terms, FAR, 
and CAS, if applicable. FAR §§ 42.101, 42.803(b), and DFARS § 
242.803. 


X 


X 




Billing rates and final 
indirect cost rates 3 


Audit: DCAA establishes billing rates for interim indirect costs and 
final indirect cost rates. FAR §§ 42.704, 42.705 and 42.705-2 and 
DFARS § 42.705-2. 


X 


X 




Defective pricing" 


Audit: DCAA determines the amount of cost adjustments related 
to defective pricing. See above authorities to audit contractor cost 
and pricing data and FAR § 15.407-1. 


X 




X 


CAS compliance" 


Audit: DCAA determines contractor and subcontractor compliance 
with CAS setforth in 48 CFR § 9903.201 and determines cost 
impacts of noncompliance. FAR §§ 1.602-2, 30.202-7, and 
30.601(C). 


X 


X 




Other specially 
requested services 


Audit and nonaudit services: DCAA conducts performance audits 
and other audits based on requests from DOD components and 
requests from other federal agencies. DOD Directive 5105.36, 
Sec. 5. 


X 




X 



Financial liaison 
advisory services" 
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Payment support 



Contract phase and 
assignment 


Audit and Nonaudit services 


Contracting 
support 


Direct Indirect 


Paid voucher reviews" 


Nonaudit services: DCAA reviews vouchers after payment to 
support continued contractor participation in the direct bill 
program. CAM 6-1007.6; FAR § 42.803; DFARS § 242.803; 
DODD 5105.36, paras. 5.4 and 5.5; and DOD Financial 
Management Regulation (F MR), vol. 10, ch. 10, para. 100202. 


X 


X 


Approval of vouchers 
prior to payment? 


Nonaudit: DCAA reviews and approves contractor interim 
vouchers for payment and suspends payment of questionable 
costs. FAR § 42.803; DFARS § 242.803(b)(i)(B); DOD Directive 
5105.36, paras. 5.4 and 5.5; and DOD FMR vol. 10, ch. 10, para. 
100202. 


X 


X 


Overpayment reviews" 


Non audit services: At the request of the contracting officer, DCAA 
reviews contractor data to identify potential contract 
overpayments. FAR §§ 2.605, 52.216-7(g), (h)2. 


X 


X 


Close-out/termination phase: 


Contract close-out 
procedures and 
audits" 


Audit: DCAA reviews final completion vouchers and the 
cumulative allowable cost worksheet and may review contract 
closing statements. DFARS § 242.803(b)(i)(D). 


X 


X 



Source: GAO analysis. 



"Indicates DCAA audit and nonaudit services covered in this audit. 

"Indicates types of audits covered in our prior investigation (G AO-08-857). We reviewed progress 
payment and contract close-out audits that related to audits in our earlier investigation or this audit 
where the auditors considered the evidence in those audits. 



Importance Of Audits in DCAA policy states 29 that it follows GAGAS 30 when conducting audits. 

Accordance with GAGAS These standards provide a framework for conducting high quality 

government audits and attestation engagements. These standards also 
provide guidelines to help government auditors maintain competence, 
integrity, objectivity, and independence in their work and require that they 
obtain sufficient evidence to support audit conclusions and opinions. 
When auditors are required to follow GAGAS or are representing to others 
that they followed GAGAS, they should follow all applicable GAGAS 
requirements and should refer to compliance with GAGAS in the auditor's 
report. 31 Most DCAA audits are performed as attestation audits under 
GAGAS. For attestation audits, GAGAS incorporates the American 



CAM, 2-101. Except where stated otherwise in this report, various types of evaluations 
entailing different levels of assurance that DCAA refers to as audits — such as examinations, 
attestations, and reviews — were subject to GAGAS. 

30 GAO-03-673G, §1.01, and GAO-07-731G, §1.03. 

31 GAO-07-731G, §1.11. 
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Institute of Certified Public Accountants (AICPA) general standard on 
criteria, and the field work and reporting standards and the related 
Statements on Standards for Attestation Engagements (SSAE), unless 
specifically excluded or modified by GAGAS. 32 DCAA also conducts 
performance audits upon request. This report addresses DCAA attestation 
audits and related supporting assignments. 

GAGAS state that the public expects auditors to observe the principles of 
serving the public interest and maintaining the highest degree of integrity, 
objectivity, and independence in discharging their professional 
responsibilities. Serving the public interest and honoring the public trust 
are critical when performing government audits. Auditors increase public 
confidence when they conduct their work with an attitude that is 
objective, fact-based, nonpartisan, and non-ideological with regard to 
audited entities and users of the auditors' reports. Auditors also should be 
intellectually honest and free of conflicts of interest in discharging their 
professional responsibilities. 33 Management of the audit organization sets 
the tone for ethical behavior throughout the organization by maintaining 
an ethical culture, clearly communicating acceptable behavior and 
expectations to each employee and creating an environment that 
reinforces and encourages ethical behavior throughout all levels of the 
organization. 34 The credibility of auditing in the government sector is 
based on auditors' objectivity and integrity in discharging their 
professional responsibilities. 35 



GAO-03-673G, § 6.01, and GAO-07-731G, § 6.01. 
GAO-07-731G, §§ 2.06 through 2.10. 
GAO-07-731G, § 2.01. 
GAO-07-731G, § 2.10. 
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Nationwide Audit 
Quality Problems Are 
Rooted in DCAA's 
Poor Management 
Environment 



We found audit quality problems at DCAA offices nationwide, as 
demonstrated by serious quality problems in the 69 audits and cost-related 
assignments we reviewed, DCAA's ineffective audit quality assurance 
program, and DCAA's rescission of 80 audit reports in response to our 
work. 36 Of the 69 audits and cost-related assignments we reviewed for this 
report, 65 exhibited serious GAGAS or other deficiencies similar to those 
found in our prior investigation, including compromise of auditor 
independence, insufficient audit testing, and inadequate planning and 
supervision. Although not as serious, the remaining four audits also had 
GAGAS compliance problems. The 69 audits and cost-related assignments 
we reviewed included 43 audits that DCAA reported were performed in 
accordance with GAGAS and 26 non-GAGAS cost-related assignments, 
including 10 overpayment and 16 paid voucher assignments. According to 
DCAA officials, DCAA rescinded the 80 audit reports because the audit 
evidence was outdated, insufficient, or inconsistent with reported 
conclusions and opinions and reliance on the reports for contracting 
decisions could pose a problem. Nearly one third (24) of the 80 rescinded 
reports relate to unsupported opinions on contractor internal controls, 
which were used as the basis for risk-assessments and planning on 
subsequent internal control and cost-related audits. Other rescinded 
reports relate to CAS compliance and contract pricing decisions. Because 
the conclusions and opinions in the rescinded reports were used to assess 
risk in planning subsequent audits, they impact the reliability of hundreds 
of other audits and contracting decisions covering billions of dollars in 
DOD expenditures. We found that DCAA's focus on a production-oriented 
mission led DCAA management to establish policies, procedures, and 
training that emphasized performing a large quantity of audits to support 
contracting decisions over audit quality. An ineffective quality assurance 
structure compounded this problem. 



Audit Quality Problems 
Found in All Audits GAO 
Reviewed 



We found audit quality problems, including GAGAS compliance problems, 
with all 37 audits of contractor internal controls and the 4 incurred cost 
and the 2 request for equitable adjustment audits we reviewed at 7 FAOs 
across the 5 DCAA regions covered in this audit. In addition, none of the 
26 cost-related assignments we reviewed from these same FAOs included 
sufficient testing to identify contractor overpayments and billing errors. 



According to documentation provided by DCAA as of the end of July 2009, the 80 
rescinded reports include 62 reports related to findings in our July 2008 investigative report 
and 18 reports related to this audit. 
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For additional details on our analysis of these DCAA audits and 
assignments, including narrative case-studies, see appendixes I and II. 

Internal Control Audits DCAA performs attestation audits of contractors' systems for cost 

accounting, estimating, and billing to gather evidence to express an 
opinion on the adequacy of the contractor's systems and related internal 
controls for compliance with applicable laws and regulations and contract 
terms. A contractor must have an adequate accounting system to be 
awarded a government cost-reimbursement contract, an adequate billing 
system to submit invoices for payment without government review, and an 
acceptable estimating system to support a contracting officer's approval of 
pricing proposals. A secondary objective of DCAA's audits of contractor 
systems and controls is to determine the degree of reliance that can be 
placed on the contractor's internal controls as a basis for planning the 
scope of other related audits. For example, if a contractor receives an 
adequate opinion on various systems control audits, auditors assess risk as 
low and reduce the level of testing on subsequent internal control and 
cost-related audits, including audits of contractors' annual incurred cost 
claims. Although the reports for all 37 audits of contractor internal 
controls that we reviewed stated that the audits were performed in 
accordance with GAGAS, we found GAGAS compliance issues with all of 
these audits. Examples of GAGAS compliance issues we found included: 

Independence issues. For 7 audits we reviewed, DCAA independence 
was compromised because auditors provided material nonaudit services 
to a contractor they later audited; experienced access to records problems 
that were not fully resolved; or significantly delayed report issuance in 
order to allow the contractors to resolve cited deficiencies. GAGAS state 
that auditors should be free from influences that restrict access to records 
or improperly modify audit scope. 37 

Insufficient evidence. We found that 33 of the 37 internal control audits 
did not include sufficient testing of internal controls to support auditor 
conclusions and opinions. GAGAS for examination-level attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the report. 38 
However, our review of audit documentation often found that only two, 
three, or sometimes five transactions were tested to support audit 



See GAO-03-673G, § 3.19, and GAO-07-731G, § 3.10. 
GAO-03-673G, § 6.04b. 
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conclusions, and the audit documentation did not contain a justification 
for the small sample sizes selected for testing. For internal control audits, 
which are relied on for 2 to 4 years and sometimes longer, the auditors 
would be expected to test a representative selection of transactions across 
the year and not transactions for just one day, one month, or a couple of 
months. 39 For many controls, the procedures performed consisted of 
documenting the auditors' understanding of controls, and the auditors did 
not test the effectiveness of the implementation and operation of controls. 

Generally, the basis for an auditor's determination of sufficient testing 
should include (1) an adequate risk assessment, taking into consideration 
any auditor alerts arising from related audits, past findings, and corrective 
actions; (2) the contractor's overall control environment; and (3) the 
nature and volume of transactions and associated materiality and risk of 
error. For example, decisions on sufficient testing of contractor internal 
controls would include consideration of the number and types of contracts 
or proposals; the nature, dollar amount, and volume of transactions; and 
key control attributes or special characteristics of the transactions. 
Further, a representative selection would include a representative number 
of transactions from a population of transactions representing a 
reasonable period of time, in order for test results to support conclusions 
and opinions on the overall adequacy of the contractor's systems and 
effectiveness of the related controls. For example, under the GAO/PCIE 
Financial Audit Manual, 40 the minimum sample size for an attribute 
sample of a control would be 45 items. 

Reporting problems. According to GAGAS, audit reports should, among 
other matters, identify the subject matter being reported and the criteria 
used to evaluate the subject matter. Criteria identify the required or 
desired state or expectation with respect to the program or operation and 
provide a context for evaluating evidence and understanding the findings. 41 
None of the 37 internal control audit reports we reviewed cited specific 
criteria used in individual audits. Instead, the reports uniformly used 
boilerplate language to state that DCAA audited for compliance with the 
"FAR, CAS, DFARS, and contract terms." As a result the user of the report 



AICPA Statements on Auditing Standards, AU 350, and Audit and Accounting Guide: 
Audit Sampling, §§ 3.14, 3.29-3.34, 3.58, and 3.61. 

40 GAO/PCIE, Financial Audit Manual, GAO-08-585G (Washington, D.C.: July 2008). 

41 GAO-07-731G, §4.15. 
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does not know the specific Federal Acquisition Regulation (FAR), Cost 
Accounting Standards (CAS), or contract terms used as criteria to test 
contractor controls. This makes it difficult for users of the reports to 
determine whether a particular report provides the level of assurance 
needed to make contracting decisions. 

The lack of sufficient support for the audit opinions on 33 of the 37 
internal control audits we reviewed rendered them unreliable for decision 
making on contract awards, direct billing privileges, the reliability of cost 
estimates, and reported direct cost and indirect cost rates. For example, 
the FAR requires 42 government contracting officers to determine the 
adequacy of a contractor's accounting system before awarding a cost- 
reimbursement contract. Of the 9 audits of contractor accounting system 
internal controls that we reviewed, only two of the audits included 
sufficient testing to support DCAA's audit opinion that internal controls 
over the contractors' accounting systems were adequate. In addition, none 
of the 20 audits of contractor billing system internal controls we reviewed 
contained sufficient testing of controls to support the reported opinions. 
Adequate opinions on billing system audits are the basis for DCAA 
decisions to approve contractors for the direct bill program, whereby 
contractors submit invoices directly to a government disbursing office 
without prior review. 43 Four of the 6 audits of contractor estimating 
system controls that we reviewed did not include sufficient testing to 
support the reported opinions. DOD requires 44 that large contractors have 
acceptable estimating systems. Opinions on contractor estimating systems 
support DCAA decisions on the extent of testing performed on contract 
proposals. Neither of the two internal control audits of contractor indirect 
and other direct costs we reviewed included sufficient testing to support 
reported opinions. As shown in figure 1, at the time these audits were 
performed, DCAA policy guidance provided for three categories of 
opinions on internal control audits. This policy provided for different 
opinions and criteria forjudging them based on the severity of the 
problems identified. Professional standards have long recognized different 
levels of severity with regard to reporting deficiencies and material 
weaknesses in internal controls. 



FAR §§ 16.104(h) and 16.301-3(a)(l). 

FAR § 42.101 and DFARS § 242.803(b)(i)(C). 

DFARS § 215.407-5-70; see FAR § 15.407-5. 
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Figure 1 : DCAA Opinions on Contractor Internal Control Systems Audits 



Risk 


DCAA opinion 


Criteria 


Resultant actions 


I 
L 


A 
01 


N 


Adequate 


No significant 
deficiencies were 
identified in the audit 


Scope of future audits will be decreased based on assurance provided by 
adequate controls. 








Inadequate in part 


Auditors identified one 
or more significant 
deficiencies that affect 
parts of the contractor's 
system 


Contractor is required to make improvements, and DCAA is to perform follow-up 

testing within 6 months. 
Inadequate in part opinion also requires expanded audit scopes on future and 

concurrent audits until the contractor's corrective actions are confirmed by 

the auditors. 


H 


iS 


h 

\ 


Inadequate 


Auditors identified one 
or more significant 
deficiencies that render 
the entire contractor 
system unreliable 


Contractor is required to make improvements and DCAA is to perform follow-up 

testing within 6 months. 
Inadequate opinion requires expanded audit scopes on other audits because 

controls do not provide reasonable assurance that data generated by the 

contractor's system are reliable. 



Source: GAO analysis of DCAA policy. 



Supervisors of the DCAA internal control audits we reviewed dropped 
auditor findings of significant deficiencies from the audit reports or 
treated them as suggestions for improvement without adequate support, 
including instances of FAR noncompliance that should have been reported 
as material weaknesses. In some cases, auditors reported "inadequate-in 
part" opinions when the severity of the deficiencies or material 
weaknesses identified would have called for "inadequate" opinions. 

On December 19, 2008, DCAA revised its policy to eliminate the 
"inadequate-in-part" opinion and the requirement to report suggestions for 
improvement. 45 The new DCAA policy defines "significant 
deficiency/material weakness" as an internal control deficiency that 
(1) adversely affects the contractor's ability to initiate, authorize, record, 
process or report government contract costs in accordance with 
applicable government contract laws and regulations; (2) results in a 
reasonable possibility that unallowable costs will be charged to the 
government; and (3) the potential unallowable cost is not clearly 
immaterial. The new DCAA policy also establishes new guidance on 



°DCAA, "Audit Guidance on Significant Deficiencies/Material Weaknesses and Audit 
Opinions on Internal Control Systems," 08-PAS-043R (Dec. 19, 2008). 



Page 18 



GAO-09-468 DCAA Audit Environment 



reporting audit opinions on contractors' internal control systems. For 
example, the new DCAA policy states that audit reports that identify any 
significant deficiencies/material weaknesses in contractors' internal 
control systems will include opinions that the systems are "inadequate." 
The policy notes that the contractor's failure to accomplish any control 
objective tested in DCAA's internal control audits will or could ultimately 
result in unallowable costs being charged to government contracts, even 
when the control objective does not have a direct relationship to charging 
costs to government contracts. As an example, the policy notes the control 
objective related to ethics and integrity is not directly related to charging 
costs to government contracts, but that the contractor's failure to 
accomplish the control objective creates an environment that could 
ultimately result in mischarging to government contracts. 

By eliminating the "inadequate-in-part" opinion, the new policy does not 
recognize different levels of severity and could unfairly penalize 
contractors whose systems have less severe deficiencies by giving them 
the same opinion — "inadequate" — as contractors having material 
weaknesses or serious deficiencies that in combination would constitute a 
material weakness. 

At the time we finalized our draft report for DOD comment, DCAA had 
rescinded 18 of the 33 audits of contractor internal controls that we 
determined did not contain sufficient testing to meet GAGAS. 46 Unreliable 
audit opinions on contractor internal controls pose a significant risk 
because DCAA generally performs these audits on a 2- to 4-year cycle and 
the audit results are relied on for several years to make decisions on 
testing in various audits of contractor internal controls and cost-related 
assignments. In response to our earlier investigation in November 2008, 
DOD added DCAA audits not meeting professional standards to its list of 
material weaknesses. 47 Table 2 provides details on five case studies that 
are typical of the flawed internal control audits that we reviewed during 
the course of our work. For more detail on the internal control audits we 
reviewed, see appendix I. 



Under its decentralized management environment, DCAA headquarters obtains field 
office agreement to rescind audit reports that do not meet GAGAS. 

47 DOD, Fiscal Year 2008 Agency Financial Report, Department of Defense (Washington, 
D.C.: Nov. 17, 2008). 
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Table 2: Summary of Five Selected Internal Control Audits 



Case Region Audit type Case details 

1 Western Billing system (2004) • DCAA auditors inappropriately planned and performed a billing system audit of a 

federally funded research and development center (grantee) with $1.5 billion in annual 
funding. The grantee does not have a "billing system." 

The grantee is funded by a line of credit, which provides for cash draws and 
transaction reporting by the grantee's accounting system. 

DCAA auditors spent 530 hours revising Single Audit Act cash management audit 
documentation to address procedures required in DCAA's standard audit program for 
billing system internal controls and developed a billing system audit report, when the 
auditors could have simply forwarded the results of work on the grantee's cash 
management system performed underthe Single AuditActto the federal agency's 
buying command. 

As a result of our review, DCAA reassessed the need to perform a billing system audit 
for the grantee and determined that it would rely on the Single Audit reports in the 
future. 

2 Western Accounting system • This audit involving accounting controls for one of the five largest DO D contractors 

(2004) working in Iraq was initiated in November 2003. 

In September 2005, after nearly 2 years of audit work, DCAA provided draft findings 
and recommendations to the contractor that included 8 significant deficiencies in the 
contractor's accounting design and operation. 

The contractor objected to the findings, stating that the auditors did not fully 
understand its new policies and procedures, which were just being developed for the 
fast track effort in Iraq. 

Following the contractor's objections, various supervisory auditors directed the 
auditors to revise and delete some workpapers, generate new workpapers, and in one 
case, copy the signature of a prior supervisor onto new workpapers making it appear 
that the prior supervisor had approved a revised risk assessment. 

On August 31, 2006, after dropping 5 significant deficiencies and downgrading 3 
significant deficiencies to suggestions for improvement, DCAA reported an "adequate" 
opinion on the contractor's accounting system without adequate audit evidence for the 
changes. 

The interim audit supervisor, who instructed the lead auditor to copy and paste the 
prior supervisor's name onto key risk assessment workpapers, was subsequently 
promoted to be the Western Region's quality assurance manager where he served as 
quality control check over thousands of audits, including those G AO reported on last 
year. 

In April 2007, the Special IG for Iraq Reconstruction (SIGIR) reported that despite 
being paid $3 million to complete the renovation of a building in Iraq, the contractor's 
work led to plumbing failures and electrical fires in a building occupied by the Iraqi 
Civil Defense Directorate. 

DCAA rescinded the audit report on December 2, 2008. 
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Case Region Audit type 



Case details 



3 Eastern Billing system (2005) • In May 2005, DCAA reported an inadequate-in-part opinion on the billing system 

internal controls of a second of the five largest DO D contractors. 

After issuing the report, DCAA auditors helped the contractor develop policies and 

procedures related to accounts receivable, overpayments, and system monitoring 

before performing a required follow-up audit— a serious impairment to auditor 

independence. 

In J une 2006, DCAA reported an adequate opinion on the contractor's billing system 
internal controls, including the policies and procedures DCAA helped the contractor 
develop. 

As a result of GAO's review, DCAA rescinded the follow-up audit report on March 6, 
2009. 

4 Central Billing system • This audit, which was initiated in J uly 2005, covered a new billing system at a 

(2005) business segment of another of the five largest DOD contractors. Although DCAA 

considers new systems to be high-risk and requires increased testing, auditors 
deleted key audit steps related to contractor policies and internal controls over 
progress payments from the standard audit program without explanation and 
performed little or no testing of the contractor's billing controls. 

The contractor objected to requests for documentation to test whether billing clerks 
had received necessary training. 

One auditor told GAO he did not perform other tests because 'the contractor would 
not appreciate it." 

The auditors provided draft findings and recommendations to the contractor in 
February 2006 that included six suggestions to improve the system related to the 
need for internal audits, oversight of subcontractor accounting systems, and 
improvements in policies and procedures and desk instructions. 

Instead of issuing the report, when audit work was completed and noting the status of 
any contractor actions to address identified control weaknesses, the auditors 
monitored contractor corrective actions for 7 months, dropping the two suggestions for 
improvement related to internal audits and monitoring subcontractor accounting 
systems. The failure to monitor subcontractor accounting systems should have been 
considered a significant deficiency. 

On September 15, 2006, DCAA reported an "adequate" opinion on the contractor's 
billing system. 

Following GAO's review of this audit, DCAA rescinded the audit report on February 
10, 2009. 
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Case Region Audit type 



Case details 



5 Central Billing system (2006) • A fraud investigation by the Army's Criminal Investigative Division was under way at 

the time DCAA performed this contractor's billing system audit. The FAO was aware 
of the substance of the Army's investigation. 

The auditor requested increases in budgeted audit hours to perform increased testing 
because of fraud risk and the contractor's use of temporary accounts for charging 
costs that had not yet been authorized by the contracting officer. 

The auditor drafted an "inadequate" opinion on the contractor's billing system, which 
was overturned by the supervisor and FAO manager. 
Despite a reported $2.8 million in fraud for this contractor, DCAA reported an 
"inadequate-in-part" opinion related to 3 significant deficiencies in the contractor's 
billing system on August 31, 2005, and an "adequate" opinion on September 11, 
2006, related to a follow-up audit. 

The auditor, whose performance appraisal was lowered for performing too much 
testing and exceeding budgeted audit hours, was assigned to and then removed from 
the follow-up audit. The auditor left DCAA in March 2007. 

Following GAO's review, DCAA rescinded both audit reports on November 20, 2008. 

Source: GAO analysis of DCAA audit documentation and auditor interviews. 



Cost-Related Assignments The 32 cost-related assignments we reviewed did not contain sufficient 

testing to provide reasonable assurance that overpayments and billing 
errors that might have occurred were identified. As a result, there is little 
assurance that any such errors, if they occurred, were corrected and that 
related improper contract payments, if any, were refunded or credited to 
the government. Contractors are responsible for ensuring that their 
billings reflect fair and reasonable prices and contain only allowable costs, 
and taxpayers expect DCAA to review these billings to provide reasonable 
assurance that the government is not paying more than it should for goods 
and services. Further, we found that DCAA does not consider some cost- 
related assignments to be GAGAS audits, even though these assignments 
are used to provide assurance of the reasonableness of contractor billings, 
for example: 

Paid voucher reviews. DCAA performs annual testing of paid vouchers 
(invoices) to determine if contractor voucher preparation procedures are 
adequate for continued contractor participation in the direct-bill 
program. 48 Under the direct-bill program, contractors may submit their 
invoices directly to the DOD disbursing officer for payment without 
further review. Although DCAA does not consider its reviews of contractor 



DCAA does not perform paid voucher reviews during the year that it performs an audit of 
the contractor's billing system internal controls. 
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paid vouchers to be GAGAS engagements; it has not determined what 
standards, if any, apply to these assignments. In addition, for the 16 paid 
voucher assignments we reviewed, we found that DCAA auditors failed to 
comply with CAM guidance. 49 Rather than documenting the population of 
vouchers, preparing sampling plans, and testing a random (statistical) 
sample, auditors generally did not identify the population of vouchers, did 
not create sampling plans, and made a small, nonrepresentative selection 
of as few as one or two invoices for testing to support conclusions on their 
work. Even when DCAA auditors tested 20 or 30 invoices, they did not test 
billing controls or review supporting documentation for goods and 
services purchased. Instead, the auditors performed limited procedures 
such as determining whether the vouchers were mathematically correct 
and included current and cumulative billed amounts. Based on this limited 
work, the auditors concluded that controls over invoice preparation were 
sufficient to support approval of the contractors' direct billing privileges. 
However, the limited work performed does not provide assurance that 
contractor billings are accurate and comply with applicable laws, the FAR, 
CAS, and contract terms. This is of particular concern because we 
determined that Defense Finance and Accounting Service (DFAS) 
certifying officers rely on DCAA voucher reviews, and they do not repeat 
review procedures they believe to be performed by DCAA. 

Professional literature contains guidance to help auditors determine the 
level of testing that should be performed to obtain sufficient, appropriate 
evidence to support a conclusion that internal controls are effectively 
designed, implemented, and operating effectively. Inquiry alone does not 
provide sufficient, appropriate evidence to support a conclusion about the 
effectiveness of a control. Some of the factors that affect the risk 
associated with a control include 

• the nature and materiality of misstatements that the control is intended 
to prevent, 

• the inherent risk associated with the related account(s) and 
assertion(s), 

• whether there have been changes in the volume or nature of 
transactions that might adversely affect control design or operating 
effectiveness, 



CAM 6-1007. 
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• the degree to which the control relies on the effectiveness of other 
controls (i.e., information technology controls), 

• the competence of personnel who perform the control or monitor its 
performance, and whether there have been changes in key personnel 
who perform the control or monitor performance, and 

• whether the control relies on performance by an individual or is 
automated (an automated control would generally be expected to be 
lower risk if relevant IT general controls are effective). 50 

Professional standards 51 state that the auditor should focus more attention 
on the areas of highest risk. As the risk associated with the control being 
tested increases, the evidence that the auditor should obtain increases. In 
addition, the GAO/PCIE Financial Audit Manual provides guidance on 
sampling control tests that would be relevant to DCAA testing of 
contractor invoices. 52 The auditor should assess risk in determining the 
control attributes to be tested and select a sample that the auditor expects 
to be representative of the population. Attribute sampling requires random 
or systematic, if appropriate, selection of sample items without 
considering the transactions' dollar amount or other special 
characteristics. To determine the sample size, the auditor uses 
professional judgment to determine three factors — confidence level, 53 
tolerable rate (maximum rate of deviations from the prescribed control 
that the auditor is willing to accept without altering the preliminary 
control risk), and expected population deviation rate (expected error 
rate). 54 



w AU § 350.19 and SSAE §§15.64 and 15.69. 

51 AU §§ 350.07 through 350.14. 

52 GAO-08-585G, § 450. 

53 Confidence interval is the probability associated with the precision, that is, the 
probability that the true misstatement is within the confidence interval. 

54 For example, for a confidence level of 90 percent and a tolerable rate of 5 percent, a 
sample size of 45 transactions would have an acceptable number of deviations of zero and 
a sample size of 78 transactions would have an acceptable number of deviations of one. For 
the same confidence level of 90 percent and a tolerable rate of 10 percent, a sample size of 
45 would have an acceptable number of deviations of one and a sample size of 78 would 
have an acceptable number of deviations of four. 
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Finally, the American Institute of Certified Public Accountants (AICPA) 
Audit and Accounting Guide: Audit Sampling 55 (Audit Guide) contains 
attestation guidance on the application of SSAEs in specific 
circumstances, including engagements for entities in specialized 
industries. The Audit Guide states that an auditor using nonstatistical 
sampling is not required to compute the sample size using statistical 
theory. However, sample sizes of statistical and nonstatistical samples 
ordinarily would be comparable when the same sampling parameters are 
used. 56 

Overpayment assignments. DCAA intends these audits to verify that 
contractors have billing procedures and internal controls in place to 
identify and resolve contractor overpayments in a timely manner. DCAA 
guidance states that these engagements should be conducted in 
accordance with GAGAS to the extent applicable under the 
circumstances. 57 However, none of the 10 overpayment assignments we 
reviewed were performed or reported as GAGAS engagements. We found 
that auditor judgments about the population and selection of transactions 
for these assignments did not provide a representative basis for testing 
and concluding on contractor controls over billings and payments 
received. For example, for the 10 assignments we reviewed, the auditors 
selectively reviewed an accounts receivable aging report to identify 
overpayments and determine if they had been resolved. The auditors did 
not attempt to identify the population of transactions subject to 
overpayments and over billings during the year, and they did not 
document their rationale for selecting a particular dollar threshold, 
number of transactions, or time period for testing contractor invoices. Our 
assessment of these assignments includes the same concerns regarding 
insufficient evidence to support the auditors' conclusions as discussed 
above for annual testing of paid vouchers. As a result, this work does not 
provide reasonable assurance that contractors have adequate controls in 
place to identify and correct overpayments and billing errors and make 
appropriate, timely refunds and adjustments. 



3 The AICPA Audit Guide is an interpretive publication pursuant to AT section 50, SSAE 
Hierarchy (AICPA, Professional Standards, vol. 1). 

56 AICPA Audit Guide § 1-17, and AU § 350.23. Statements on Auditing Standards (SAS) 39 
is referred to as AU 350. 

57 DCAA, "Audit Program: Audit of Contractor Overpayments," (Activity Code 17310), April 
2004, September 2007, and May 2008. 
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Incurred cost audits. The purpose of incurred cost audits is to examine 
contractors' cost representations and opine on whether the costs are 
allowable, allocable to government contracts, and reasonable in 
accordance with the contract and applicable government acquisition 
regulations. 58 DCAA performs these audits as GAGAS attestation 
engagements. For the four incurred cost audits we reviewed, we found 
that the auditors did not adequately document their judgments about 
control risk or the sampling and test methodologies used. In addition, we 
found that the auditors traced claimed pool and base costs (indirect costs) 
to the contractor's accounting books and records to determine their 
accuracy and allowability. However, the auditors did not perform 
sufficient, detailed testing of support for claimed indirect and direct costs. 
The scope of work performed was not sufficient to identify claimed costs, 
if any, that were not adequately supported or unallowable costs, if any, 
that should have been questioned. 

In addition to the testing failures we identified on the 32 cost-related 
assignments, several additional issues came to our attention during our 
review: 

Exempting from professional standards certain assignments that 
were used as support for internal control system audits. We noted 
that paid voucher reviews and overpayment assignments, which were used 
to support direct-bill decisions and billing system audits, were not 
performed under GAGAS, even though some of them used the same 
terminology as GAGAS engagements to describe the work performed, 
including "comprehensive examination" and "audit." According to DCAA's 
CAM and DCAA officials, paid voucher reviews and most overpayment 
assignments are not intended to meet GAGAS standards. However, paid 
voucher reviews are intended to serve as audits of contractor payments, 
and DCAA's standard audit program for overpayment assignments states 
that the assignments are to be performed in accordance with GAGAS, 
unless there are specific exceptions. When these types of assignments are 
not conducted under professional standards, it is important for the report 
to clearly state the procedures performed and the intended uses of the 
report, such as verifying compliance with certain FAR requirements, in 
order to provide context for understanding the stated conclusions of the 
work and avoid misleading users of the report. 



CAM 6-102. 
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Auditor objectivity issues. We also determined that DCAA's role with 
regard to making decisions to approve contractors for participation in the 
direct-bill program 59 presented an impairment to auditor objectivity — 
which includes being independent in fact and appearance when providing 
audit and attestation engagements. 60 The objectivity impairment relates to 
DCAA's audit role in authorizing contractors to participate in the direct- 
bill program, which places it in the position of making decisions that 
impact its nonaudit workload related to the review of contractor invoices 
prior to payment. For example, when contractors do not have direct billing 
privileges, DCAA acts as the authorized representative of the DOD 
contracting officer in reviewing contractor invoices prior to submission 
for payment. However, if DCAA auditors determine that a contractor has 
an adequate billing system, DCAA may authorize a contractor to 
participate in the direct-bill program, thereby eliminating workload related 
to review of the contractor's invoices prior to payment. In addition, the 20 
billing system audits and follow-up audits we reviewed lacked sufficient 
testing to support reported opinions, or the opinions reported were 
inconsistent with the audit evidence. DCAA had approved all but 2 of the 
16 contractors involved in these audits for the direct bill program. 

At the end of our audit, DCAA had not rescinded any of the memorandums 
or reports on the results of the cost-related assignments we reviewed. 
Table 3 provides details on five selected case studies of flawed cost- 
related assignments that we reviewed during the course of our work. 



FAR 42.101, DFARS 242.803(b)(1)(c), and CAM 6-1007. 
GAO-03-673G, §§ 3.03 through 3.18. 
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Table 3: Summary of Five Selected Cost-Related Assignments 



Case Region 



Type of 
assignment 



Case details 



Eastern Paid voucher review 
(2004) 

Non-GAGAS 



This contractor generates $1.1 billion in annual billings to the government. 

The auditor assessed risk as low for this assignment without documenting the basis 
for the decision. The auditor then judgmentally selected 3 vouchers totaling $88,000 
for testing out of a total of 222 vouchers submitted to the government for payment 
from March 2003 through February 2004. 

The auditor tested the first voucher selected and performed limited testing on the 
remaining 2 vouchers. The workpapers do not include any evidence to show that the 
auditor performed most of the audit steps required in the standard audit program. 

Despite limited testing, on March 31, 2004, DCAA prepared a Memorandum for the 
Record, stating "continued reliance can be placed on the contractor's procedures for 
the preparation of interim vouchers... " and "the contractor has met the criteria for 
continued participation in the direct billing program." 



Mid-Atlantic 



Paid voucher review 
(2004) 

Non-GAGAS 



In 2004, DCAA reviewed interim vouchers submitted by a contractor with $40 million 
in annual sales. 

The auditor chose a nonrepresentative selection of 3 vouchers totaling $621,000 
from a 3-month period. The auditor should have used a population covering a 12- 
month period because this assignment was designed to cover a 1-year period. 

The auditor did not document the sample selection methodology as required by 
DCAA's CAM. Although testing of 3 vouchers is not sufficient to support a 
conclusion on the effectiveness of the contractor's controls over preparation of 
interim vouchers, the auditor removed one of the 3 vouchers from testing and did not 
document a reason. 

The auditor did not identify any errors in testing the two remaining vouchers. 

On August 31, 2004, DCAA reported "continued reliance can be placed on the 
contractor's procedures for the preparation of interim vouchers" and 'the contractor 
had met the criteria for continued participation in the direct billing program." 



Western 



Paid voucher 
review (2005) 
Non-GAGAS 



This DOD contractor with over $1 billion in annual billings to the government was 
one of several contractors that performed work to support the FBI's Trilogy 
investigative systems upgrade project. 

The auditor tested less than 20 vouchers of 5,530 vouchers issued in a 12-month 
period. 

On April 14, 2005, DCAA issued a Memorandum for the Record, stating "continued 
reliance can be placed on the contractor's procedures for the preparation of interim 
vouchers" and 'the contractor has met the criteria for continued participation in the 
direct-bill program. 

One year later, a G AO audit report revealed that during the time of this DCAA 
assignment, the contractor had over billed the FBI by over $400,000 in labor and 
improper first-class travel costs. 
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Case Region 


Type of 
assignment 


Case details 


4 Central 


Overpayment 
assignment (2005) 

Non-GAGAS 


This DCAA assignment covered one of the five largest DO D contractors. 

The auditor tested 4 transactions from a listing of potential underpayments and 
overpayments prepared by the contractor. The auditor did not independently verify 
the accuracy or completeness of the contractor's listing. 



The audit program required the auditor to determine whether the contractor monitors 
the billings submitted by its top 3 to 5 subcontractors. However, the auditor 
performed this procedure for only 1 subcontractor based on "auditor judgment" and 
did not document the basis for this judgment in the audit documentation. 

The auditor also relied on the unverified contractor-provided listing to identify 
refunds to the government. The auditor then "judgmentally selected" 2 refunds for 
testing from the contractor's listing. 

The auditors' conclusions that the contractor's controls are sufficient to detect and 
correct billing errors and overpayments were not supported by sufficient testing or 
other independent evidence. 

This audit covered a $516 million incurred cost claim submitted by a contactor 
performing reconstruction work in Iraq. 

The auditors reported about $6 million in questioned costs and about $83 million in 
unsupported costs based on assist audits (portions of the audit performed by other 
FAOs) that had not been received by the report issue date. 

Although the auditors charged 2,292 hours to this assignment, GAO determined that 
the auditors did not perform sufficient work to support the audit opinion. For 
example, the auditors traced claimed pool and base costs to the contractor's 
accounting books and records using a threshold of $5 million for cost-type contracts 
and $2 million for time and materials contracts, but did not perform detailed testing 
of support for transactions. Tracing amounts to the general ledger is not sufficient 
work to support an examination-level opinion and the auditors did not document the 
basis for the judgment used to determine the multimillion dollar thresholds. 

Further, the auditors relied on testing performed in a related accounting system 
audit, which DCAA rescinded on December 2, 2008, in response to GAO concerns. 

As a result, the auditor's risk assessment used to plan the incurred cost audit is no 
longer supported. 



Source: GAO analysis of DCAA audit documentation and auditor interviews. 



We did not attempt to re-perform these assignments to find out whether 
actual overpayments or billing errors existed. For additional details on the 
cost-related assignments we reviewed, see appendix II. 



We found that a management environment and agency culture that 
focused on facilitating the award of contracts and an ineffective audit 
quality assurance structure are at the root of the agencywide audit failures 
we identified. DCAA's mission and management goals focus on producing 
a large quantity of audits to support procurement and contract 
administration rather than assuring proper contract costs that help save 



5 Western Incurred cost 
audit (2004) 
GAGAS 



Poor Management 
Environment and Quality 
Assurance Structure at 
DCAA Impacted Audit 
Quality 
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taxpayer dollars. In addition, an ineffective audit quality control system 
and a "clean" peer review opinion compounded the problem, hindering 
DCAA management from identifying and correcting agencywide audit 
quality problems. 

DCAA's Mission Statement and DCAA's current mission statement does not address protecting the public 
Strategic Plan Do Not Focus on interest in the manner in which it carries out audits to help assure that 
the Public Interest contractors charge fair and reasonable prices that comply with applicable 

laws and regulations, cost accounting standards, and contract terms. 
Instead, DCAA's mission statement calls for it to perform all necessary 
contract audits for DOD and provide accounting and financial advisory 
services regarding contracts and subcontracts to all DOD components 
responsible for procurement and contract administration. Similarly, 
DCAA's 2006 strategic plan focused on various processes and outputs. 
DCAA's strategic plan contains the following five strategic goals with 
targeted completion dates from 2006 through 2008: 

1. fostering a quality work-life environment that promotes trust, 
teamwork, mutual respect, superior job performance and high morale; 

2. assuring customer satisfaction by providing timely and responsible 
audits and financial services that meet or exceed customer 
requirements and expectations; 

3. attaining the highest level of professional competence through 
continuous improvement in the management and performance of 
audits and services; 

4. providing best value audit and financial services through continuous 
evaluation and improvement of audit and administrative processes; 
and 

5. providing an integrated information technology structure that 
promotes effectiveness and efficiency in providing services for internal 
and external customers. 

DCAA objectives under each strategic goal focus on process 
improvements and do not contain a clear plan for achieving the respective 
goal or adequate quantitative and qualitative measures for determining 
success, for example: 

• One DCAA quality of work-life objective is to assess whether the 
participative work team concept is the best model for facilitating 
continuous process improvement. The underlying activities include 
internal meetings and brainstorming sessions, literature reviews, and 
developing recommendations for executive committee review. None of 
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the activities included refer to identifying best practices or working 
with outside experts. 

• Another objective is to hold or lower attrition in high turnover areas. 
DCAA activities in this area include analyzing causes of attrition, and 
conducting surveys of new hires and departing employees. None of the 
related activities include surveys of like organizations, consideration of 
best practices, or identifying and addressing causes of high attrition. 
Moreover, in response to our requests for attrition data, DCAA 
provided high-level summaries without any analysis. 

• DCAA's strategic goal for customer satisfaction, included the objective 
of increasing by 20 percent annually the number of incurred cost audit 
reports issued with contractor cumulative allowable cost worksheets, 
completing 100 percent of identified incurred cost audits necessary to 
accomplish Defense Contract Management Agency (DCMA) 
performance goals for contract close-out and canceling funds. 61 
DCAA's strategic plan contains no explanation of the importance of 
these objectives or how they link to DCAA's mission. 

• A key goal related to best value audit services is for DCAA to manage 
its cost per direct audit hour at a level sufficient to maintain DCAA's 
competitive advantage over the comparable national public firm 
composite rate. One of the ways DCAA has achieved a low cost per 
audit hour is to maintain a pay structure that caps journey-level 
auditors at the GS-12 level. In addition, our work identified numerous 
instances where entry-level auditors with little or no experience often 
perform audit assignments by themselves. However, lower grade levels 
and limited experience can place auditors at a disadvantage when 
dealing with contractor officials. 

The Government Performance and Results Act of 1993 (GPRA) 62 directed 
federal agencies to shift their focus from traditional concerns of staffing 
and activity levels to a broad focus on outcomes or results by (1) defining 
a clear mission and desired outcomes instead of outputs, (2) measuring 
performance to gauge progress, and (3) using performance information as 
a basis for decision making. The act required agencies to meet with 
Congress and key stakeholders to clearly define their mission and develop 



Canceling funds refers to the point in time at which the availability of a fixed-year 
appropriation cancels and is no longer available for recording, adjusting, and liquidating 
obligations properly chargeable to the appropriation. (31 U.S.C. §§ 1552(a) and 1553(b)). 

62 Pub. L. No. 103-62, 107 Stat. 285 (Aug. 3, 1993). 
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long-term strategic goals as well as annual goals that were linked to them. 
Although these legislated requirements were directed at federal agencies, 
including DOD, DCAA's mission statement and strategic plan were not 
revised to conform to GPRA requirements. 

Performance Metrics Were GPRA also requires that once federal agencies establish their strategic 

Designed To Measure Output goals they are to develop results-oriented measures for assessing 

performance in meeting those goals and publicly report on how well they 
are doing. However, most of DCAA's performance metrics continued to 
focus on output. Several DCAA managers noted that fear of outsourcing 
the contract audit function led DCAA to emphasize performance metrics 
that demonstrated high productivity and low cost. In fiscal year 2008, 
DCAA reported some results-oriented performance measures, such as 
return on investment and net savings related to questioned cost. However, 
most of DCAA's metrics focused on production and audit cost, including 
cost per direct audit hour, 30-day cycle time on forward pricing audits, and 
dollars audited per hour. In addition, DCAA's focus on completing over 
30,000 assignments annually with about 3,600 auditors continued to 
emphasize production of audits instead of performing quality audits that 
assured taxpayers that the government was paying fair and reasonable 
prices for contracted goods and services. 

DCAA's Audit Quality DCAA's audit quality assurance program was not properly implemented, 

Assurance Program Was resulting in an ineffective quality control process that accepted audits with 

Ineffective significant deficiencies and noncompliance with GAGAS and DCAA policy. 

Moreover, even when DCAA's quality assurance documentation showed 
evidence of serious deficiencies within individual offices, those offices 
were given satisfactory ratings. GAGAS require that each audit 
organization performing audits and attestation engagements in accordance 
with GAGAS should have a system of quality control that is designed to 
provide the audit organization with reasonable assurance that the 
organization and its personnel comply with professional standards and 
applicable legal and regulatory requirements, and have an external peer 
review at least once every 3 years. 63 

Our analysis of DCAA audit quality review documentation for 14 of 48 
offices covered in audit quality reviews during fiscal years 2004 through 
2006 — the period covered in the last DOD OIG peer review — found that 
although DCAA gave satisfactory ratings to 13 of the 14 FAOs, DCAA 



GAO-07-731G, §§ 3.50-3.52. 
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reviewers reported that 10 of these offices had 2 or more instances of 
serious GAGAS noncompliance, including inadequate planning, lack of 
proper supervision, and insufficient support for reported conclusions and 
opinions. However, DCAA gave only 1 of the 14 FAOs reviewed an 
unsatisfactory rating. The failed FAO had 5 of 9 assignments reviewed with 
at least two significant instances of noncompliance with GAGAS or DCAA 
policy. Further, although DCAA headquarters performed a follow-up 
review to confirm that problems identified at the failed office were 
corrected, DCAA headquarters officials told us they did not perform 
follow-up reviews to assure that the problems identified at other offices 
were corrected. 

In response to a DOD IG finding that DCAA quality assurance reviews did 
not cover a sufficient number of internal control system audits, DCAA 
increased the number of audits covered to date in its fiscal year 2007 and 
2008 quality assurance reviews. However, DCAA continued to 
inappropriately conclude that audits "demonstrated professional 
judgment," allowing reviewers to disregard serious deficiencies with 
GAGAS in concluding on overall audit quality. 64 DCAA failed only 1 of the 
40 FAOs as a result of its fiscal year 2007 and 2008 audit quality reviews. 
Our analysis of DCAA's audit quality results showed that 19 of the 40 
FAO's had two or more audits with at least 2 instances of significant 
noncompliance with GAGAS or DCAA policy. However, 18 of these FAOs 
received a satisfactory rating. DCAA headquarters has not yet followed up 
with offices that had deficient audits. 

The examples in table 4 show the disparity between DCAA quality 
assurance reports of a "satisfactory level of compliance" and actual results 
documented by quality assurance reviewers. The examples below also 
illustrate the long-term nature of this problem. 



M In using professional judgment, GAGAS (GAO-07-731G, §§ 3.32 and 3.35) require auditors 
to act diligently in accordance with applicable professional standards and ethical principles 
in all aspects of carrying out their professional responsibilities. 
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Table 4: Summary of Selected DCAA Audit Quality Review Results 



Number and type 

Region of audits DCAA audit quality review conclusions and findings 

Eastern 5 incurred cost On October 28, 2008, DCAA reported a satisfactory level of compliance for the FAO reviewed. 

audits Supporting documentation showed that reviewers found that 2 of 5 audits reviewed had at least 

2 instances of significant noncompliance with GAGAS and DCAA policy, including insufficient 
supervisory involvement and inadequate workpaper documentation to support significant auditor 
judgments and conclusions. 

On September 27, 2007, DCAA reported satisfactory compliance by the FAO reviewed. 
Supporting documentation showed that reviewers found that 4 of 8 audits had at least 2 
significant instances of noncompliance with GAGAS or DCAA policy and 2 of the 4 audits had 3 
instances of noncompliance, including inadequate planning and supervision and failure to 
exercise reasonable professional judgment. 

Central 8 other (various) On April 4, 2006, reviewers gave the FAO reviewed a satisfactory rating. However, supporting 

assignments documentation showed that audit quality reviewers found that 2 of 8 assignments had at least 

two significant deficiencies related to noncompliance with GAGAS and DCAA policy, including 
inadequate planning on 3 assignments and inadequate supervision on 2 assignments. 
Reviewers also determined thatthe auditor on one other assignment had not metthe annual 
requirement for continuing professional education. 

O n April 26, 2005, reviewers gave the FAO a satisfactory rating. Although the audit quality 
review documentation identified only 1 audit that had at least 2 instances of significant 
deficiencies, the documentation noted limited testing and stated that statistical sampling was not 
used, as required. The reviewers also found that audit working papers did not support the 
conclusions in the audit report. The reviewers noted that insufficient supervisory involvement 
was responsible in part for the deficiencies found in the audit. 

On September 29, 2005, reviewers reported a satisfactory level of compliance forthis FAO. 
However, supporting documentation showed that4 of the 6 audits had at least 2 significant 
deficiencies related to noncompliance with GAGAS and DCAA policy. For example, audit quality 
reviewers noted thatthe risk assessment for one assignment inappropriately stated the 
contractor's accounting system was adequate. In addition, reviewers stated that conclusions and 
opinions in reports for three audits were not based on sufficient evidence. Reviewers also noted 
that three audits had significant deficiencies, including insufficient testing, inadequate 
procedures to identify illegal acts and noncompliance with laws and regulations, and reporting 
problems. Reviewers also found inaccuracies in reporting on three audits and stated that reports 
on 2 of the audits should not have been issued and a reported qualification in the report for the 
third audit was worded incorrectly and implied that work had been performed when the related 
assist audits had not been completed. 

On J une 8, 2004, DCAA reported satisfactory compliance by the FAO reviewed. However, 
supporting documentation showed that 2 of 6 audits reviewed had at least 2 instances of 
significant noncompliance with GAGAS and DCAA policy, including inadequate supervision, 
missing workpapers on the contractor's control environment, and insufficient and incomplete 
workpaper evidence to support conclusions in the audit reports. 

North-eastern 8 forward pricing On J une 26, 2003, DCAA reviewers reported satisfactory level of compliance by the FAO 

audits reviewed. Audit quality review documentation showed that reviewers found that 6 of the 8 audits 

had at least 2 instances of significant GAGAS or DCAA policy noncompliance. For example, 2 
audits were not adequately planned and 4 audits had inadequate supervisory involvement. In 
addition, supervisory review was performed 10 days after the report was issued on one audit, 
and audit work did not support the reported opinion on a second audit. 



Source: GAO analysis of DCAA documentation. 



North-eastern 8 forward pricing 
audits 



Western 5 incurred cost 

audits 



Mid-Atlantic 6 incurred cost 
audits 



Eastern 6 internal control 

audits 
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In March 2009, DCAA officials advised us that going forward, DCAA plans 
to report all audit quality review findings along with recommendations for 
corrective action and follow-up to assure that FAOs have taken 
appropriate corrective action. 

DOD IG Peer Review Opinion The DOD IG reported an adequate ("clean") opinion on DCAA's most 
on DCAA's Audit Quality recent peer review results although the reported evidence indicated that 

Control System Is Inconsistent numerous audits had serious deficiencies in audit quality. 65 In conducting 
with the Underlying DOD's audit oversight review of DCAA audits for fiscal year 2006, DOD IG 

Deficiencies Reported audit oversight reviewers considered the same results of DCAA's internal 

audit quality assurance reviews that we analyzed and reviewed numerous 
additional audits, which also identified significant GAGAS noncompliance 
as evidenced by DOD IG peer review findings and recommendations. 
Although the DOD IG report contained evidence of significant, systemic 
noncompliance with professional standards throughout DCAA audits that 
OIG staff reviewed, and the IG report included numerous findings and 
recommendations related to those issues, the DOD IG gave DCAA a 
"clean" peer review opinion, 66 concluding that: 

"In our opinion, the DCAA system of quality control for audits and 
attestation engagements performed during the FT ended September 30, 
2006, was designed in accordance with quality standards established by 
Government Auditing Standards (GAS). Further, the internal quality 
control system was operating effectively to provide reasonable 
assurance that DCAA personnel were following established policies, 
procedures, and applicable auditing standards. Accordingly, we have 
determined that the DCAA system of quality control used on audits and 
attestation engagements for the review period ended September 30, 
2006, is adequate." 

The overall report conclusion in the DOD IG report is not consistent with 
the detailed observations in the report, which indicate numerous 
significant deficiencies in DCAA's system of quality control. Furthermore, 
based on DCAA's actions to rescind dozens of audit reports 67 related to our 



3 All 10 categories of recommendations in the DOD IG's report related to GAGAS 
compliance problems. 

66 DOD Inspector General, Oversight Review: Review of the Defense Contract Audit 
Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 

67 Of the 80 rescinded audit reports, 39 reports were issued in fiscal year 2006 — the period 
covered in the DOD IG peer review report on DCAA. 
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prior investigation and this audit and our analysis of DCAA's internal audit 
quality review procedures and documentation — all of which relate to the 
period covered by the DOD IG peer review — we concluded that DCAA's 
quality control system for the period covered by the last DOD IG peer 
review was not effectively designed and implemented to provide 
assurance that DCAA and its personnel comply with professional 
standards. The DCAA audits performed during fiscal years 2007 and 2008 
were performed under the same policy guidance and production-related 
performance metrics as the earlier audits and had the same types of 
GAGAS noncompliance, as indicated by DCAA's internal audit quality 
review findings for audit reports issued in fiscal years 2007 and 2008. 

DCAA Lacks a Risk-Based m the absence of a risk-based audit planning approach, DCAA has 

Audit Planning Approach historically performed 30,000 to 40,000 audits annually to support 

contracting community decisions on contract awards, administration, and 
close-out using 3,000 to 4,000 auditors — an average of about 10 audit 
reports per year for each auditor. The large number of assignments has 
contributed to the production-oriented environment and widespread 
problems we have identified with audit quality. The failure to perform 
quality audits leaves government contracting officers and disbursing 
officers with inadequate information, ultimately putting taxpayers at risk 
of improper contract payments and fraud, waste, abuse, and 
mismanagement. GAO's Standards for Internal Control in the Federal 
Government 68 require federal agency managers to identify and assess 
relevant risks the agency faces from external and internal sources 
associated with achieving agency objectives, such as those defined in 
strategic and annual performance plans developed under the GPRA. To do 
this, management needs to consider all significant interactions between 
the entity and other parties as well as internal factors at the agency and 
activity levels. The specific risk analysis methodology used can vary by 
agency because of differences in agency missions and the difficulty in 
qualitatively and quantitatively assigning risk levels. For example, DCAA 
would need to consider requirements in law and federal regulation to audit 
contractor cost, price, schedule, systems, and compliance with laws, 
regulations, cost accounting standards, and contract terms. DCAA also 
would need to consider risks associated with contractor activity and the 
materiality of contractor costs. Once risks have been identified, sound 
management controls require that they should be analyzed for their 



GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: November 1999). 



Page 36 



GAO-09-468 DCAA Audit Environment 



possible effect, and management should decide how to manage the risk 
and what actions should be taken. 

A risk-based audit approach would help identify and prioritize which 
audits are the most important or have the highest return on investment 
and determine what constitutes appropriate testing for various audit and 
nonaudit services. Basing future audit plans on historical DCAA audit hour 
data is problematic because DCAA has not yet determined the time and 
effort that would be needed to perform quality audits. For example, 
historical audit hour data do not accurately reflect either the time needed 
to complete a quality audit or the hours actually worked on various audits 
because many auditors performed limited procedures or they performed 
audit procedures on their own time to meet budgeted audit hour metrics. 
In addition, some audits may not be necessary. For example, we 
concluded that 3 of the 37 internal control audits that we reviewed were 
not necessary. For one of the three audits, DCAA could have relied on the 
audit of a grantee that was performed under the Single Audit Act. 69 DCAA 
agreed with our conclusion. Two other unnecessary audits involved 
estimating systems of contractors that only have one contract with the 
government. Because contract proposals, which would be tested as part of 
the estimating system audit for these contractors, are separately audited 
when they are submitted, we questioned the need for separate estimating 
system audits for these contractors. DCAA officials told us they would 
reconsider the need for separate estimating system audits in such cases. 

Developing a risk-based audit approach that considers the risk of 
improper contract payments and available resources would also be a first 
step in determining the level of audit resources and training needed to 
accomplish effective contract audits. In addition, determining appropriate 
roles and responsibilities for nonaudit assignments would further clarify 
DCAA audit resource needs as well as needed job skills and funding for 
buying commands and DCMA. 

The most pervasive audit deficiency we identified was insufficient testing 
to support DCAA's reported conclusions and opinions. Limited audit 
testing was directly related to DCAA's goal of performing 30,000 or more 



Codified, as amended, at 31 U.S.C. ch. 75. The Single Audit Act requires that a state, local 
government or non-profit organization that expends more than $500,000 in a fiscal year 
undergo a single audit, which includes an audit of the entity's financial statements and 
Schedule of Expenditures of Federal Awards, as well as testing of and reporting on certain 
internal controls. 
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audit assignments annually. Achieving a goal of performing quality audits 
will depend, in part, on appropriate guidance on testing coupled with 
adequate training and supervision. Quality audits will also be dependent 
upon contracting community support of a risk-based audit approach and 
an appropriate delegation of nonaudit contract administration activities 
and audit responsibilities among DCMA, buying commands, and DCAA. As 
noted above, DCAA provides nearly all of its services to the contracting 
and finance communities as GAGAS audits. However, a risk-based audit 
approach may require these communities to re-evaluate whether all such 
services should be provided as audits and whether DCAA, as an 
independent audit organization would perform any nonaudit services. 

DCAA Lacks Effective Human DCAA's deficiencies in audit quality are directly related to its human 
Capital Management capital management. Effective, efficient contract audits and oversight are 

dependent on a workforce that has the required skills to meet 
organizational goals and perform quality audits that serve the public 
interest, especially the taxpayer. Both GAGAS and GAO's Internal Control 
Standards 10 require that personnel possess and maintain a level of 
competence that allows them to accomplish their assigned duties. GAGAS 
specifically requires that the staff assigned to conduct audit or attestation 
engagements under GAGAS must collectively possess the technical 
knowledge, skills, and experience necessary to be competent for the type 
of work being performed before beginning that assignment. 71 GAGAS also 
requires attestation engagements to be properly supervised. 72 Accordingly, 
agency management has a responsibility to identify appropriate 
knowledge and skills needed for various jobs and provide needed training, 
as well as candid and constructive counseling, and performance 
appraisals. DCAA's human capital management practices of hiring auditors 
at the entry-level and assigning them to complex audits with little 
classroom training or on-the-job experience and minimal supervision have 
contributed to the audit problems we identified. 

Inadequate training and supervision. DCAA headquarters officials 
acknowledged that the agency could improve developmental training and 
that it does not have continuing training for DCAA auditors throughout 
their career, referred to by DCAA as life-cycle training. Given the 



GAO-07-731G §§ 3.40 through 3.49, and GAO/AIMD-00-21.3.1. 
GAO-07-731G, § 3.43. 

GAO-03-673G, § 60.04a, and GAO-07-731G, § 6.04a. 
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complexity of contract audits and identified DCAA audit quality problems, 
timely and effective training and appropriate supervision are critical to 
achieving effective audits. Auditors also should understand the 
professional standards they are required to follow. 

In addition, we found that on-the-job-training and supervision, which are 
key components of developmental training, were not consistently provided 
to new auditors. On-the-job training for new auditors varied by supervisor 
and by DCAA field office. For example, we previously reported 73 that one 
of the offices in our hotline investigation had addressed this training need 
by assigning one supervisor to oversee trainee auditors and assigning 
trainee auditors to senior auditors who provided them on-the-job training 
during a particular audit. However, we identified 13 CAS compliance 
audits at this same office to which trainee auditors were assigned with 
little or no training or supervision. In addition, documentation for one of 
the team performance awards that we recently obtained from this office 
contained evidence that some trainee auditors were immediately given an 
audit assignment to carry out on their own. The performance award 
documentation stated as an achievement that "new hires were purposely 
assigned their own assignments as early as deemed appropriate in order to 
instill in them early the concept that they are responsible for the planning 
and conduct of their assigned audits. The supervisory and senior 
auditor. . .made a conscious decision to do this to avoid dependency issues 
with the new auditors." 

Our discussions with auditors in DCAA's 5 regions provide anecdotal 
examples of the training problems we found. For example, one auditor 
told us that entry level training is a "one-size-fits-all" approach that does 
not provide the right training at the right time, while four auditors told us 
they were not given enough time to develop their skills. One consistent 
comment from auditors was that on-the-job training was key to auditor 
effectiveness, but DCAA provided little or no opportunity for new auditors 
to obtain this developmental experience. Several auditors told us that 
trainees in their offices are given assignments to do on their own and that 
while trainees may work with a senior level auditor, sometimes these 
senior auditors do not take a leadership role that would provide a learning 
experience for trainees. In addition, several auditors described DCAA's 
internal training courses as "good," but noted that the courses covered 
high-level conceptual and technical information and did not provide the 



GAO-08-857. 
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detailed knowledge on how to apply this information when performing a 
particular contractor audit. Some FAO managers share this concern. 

Supervisors responsible for deficient audits identified in GAO's 
prior investigation were promoted. At the September 2008 hearing, 
Committee Members expressed concerns about DCAA promotions of 
supervisors who were responsible for improperly dropped audit findings, 
unsubstantiated changes in audit opinions, and abusive management 
actions against whistleblowers at locations covered in our investigation. 
Best practices of leading organizations making organizational and cultural 
changes include top leadership who set the direction, pace, and tone and 
provides a clear, consistent rationale that unites staff together behind a 
single mission. Agency management plays a key role by setting and 
maintaining the organization's ethical tone, providing guidance for proper 
behavior, removing temptations for unethical behavior, and providing 
discipline, when appropriate. Our review of GAO hotline allegations 
received since our investigation showed that meeting metrics related to 
producing reports within budgeted hours and planned time frames 
resulted in performance awards for auditors who performed deficient 
audits with little or no testing and lower performance ratings and 
personnel actions that resulted in downgrades and termination of auditors 
who did not meet these metrics. Further, our analysis of performance 
appraisals and performance award information for auditors and 
supervisors at the location in our investigation where supervisors had 
been promoted 74 showed that the supervisory auditors responsible for 
deficient audits at this location were rewarded with high performance 
appraisals, cash awards, and promotions. 

We obtained performance evaluations and performance award 
documentation for auditors and supervisors involved with 12 audits that 
had serious deficiencies at the first location we investigated in our prior 
work. The DCAA Director told us that there are legal issues associated 
with holding employees, such as the supervisory auditors, accountable for 
actions that were identified after-the-fact. However, the two supervisory 
auditors responsible for the deficient audits were approved for promotion 
even though Western Region managers who made promotion decisions 
were aware of the GAGAS compliance problems. DCAA's Western Region 
management had received the DOD IG's January 24, 2007, memorandum of 
investigation covering 10 audits performed at this location that did not 



GAO-08-857. 
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meet GAGAS. Further, during the summer of 2007, Region management 
was responding to issues identified in our hotline investigation, which 
mirrored the IG's concerns and raised concerns about GAGAS compliance 
with four additional audits. Despite these findings, we found no evidence 
that supervisors and auditors who did not follow GAGAS and DCAA policy 
were disciplined, counseled, or required to take additional training. 
Instead, our review of performance appraisal and awards documentation 
showed that the supervisors and auditors responsible for the deficient 
audits received performance appraisals ranging from "exceeds fully 
successful" to "outstanding" along with numerous cash awards. One of the 
two supervisors responsible for inappropriate decisions to drop audit 
findings and change opinions without supporting evidence was promoted 
on October 14, 2007, and the second supervisor was selected for 
promotion on July 25, 2008 — 3 days after our investigative report was 
issued. DCAA placed a hold on the second supervisor's promotion pending 
further investigation. In addition, a senior auditor who dropped audit 
findings without support at the direction of the second supervisor was 
promoted to a supervisory auditor position on January 6, 2008. In contrast, 
the performance appraisal of the senior auditor witness from that office 
who testified at the Committee's September 2008 hearing was lowered two 
levels from "outstanding" to "fully successful" following the submission of 
her hotline complaint, and she received no cash awards. DCAA has 
rescinded all 12 audit reports and re-performed the 12 audits associated 
with our investigation at this field location. 

Allegations about abusive management actions have continued. We 

found that DCAA's current organization is highly decentralized, fostering a 
culture of region autonomy. Within this culture, DCAA's Western Region 
appears to have continuing problems with unresolved allegations of 
abusive management actions. For example, 21 of the 34 DCAA hotline 
allegations we received since our July 2008 report, 75 include examples of 
abusive management actions, such as auditors being penalized for 
attempting to perform what they believe was sufficient testing to support 
audit opinions and auditors not completing work within established 
timeframes. Nine of these 21 allegations relate to DCAA's Western 
Region — the subject region in our prior hotline investigations. Seven of the 
9 allegations relate to current problems in the Western Region. Our review 



3 We spoke to the auditors and reviewed documentation they provided. To the extent that 
the auditors also submitted complaints to DCAA's anonymous Web site, we reviewed 
DCAA's handling of their complaints. 
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of DCAA anonymous Web site contacts as of the end of May 2007 showed 
that over 40 percent (65 of 152) of the DCAA contacts also relate to the 
Western Region, including several that pertain to abusive management 
actions. 76 Although DCAA headquarters officials have followed up on some 
of the complaints about management abuse that they received, decisions 
on disciplinary or corrective action typically have been delegated to region 
management. DCAA headquarters officials explained that in several cases, 
Western Region management has not agreed to take disciplinary or other 
available corrective actions. The officials told us that DCAA hotline staff 
have no recourse in these situations. 



DCAA Has Made 
Progress, but 
Correcting 
Fundamental 
Problems in Agency 
Culture That Have 
Impacted Audit 
Quality Will Require 
Sustained Leadership 



Although DCAA has taken several positive steps, much more needs to be 
done to address widespread audit quality problems. DCAA's production- 
oriented culture is deeply imbedded and likely will take several years to 
change. Under the decentralized management environment, there has been 
little headquarters oversight of DCAA regions, as demonstrated by 
nationwide audit quality problems. Further, DCAA's culture has focused 
on hiring and promoting from within the agency and most training has 
been conducted by agency staff. This has led to a very insular culture 
where there are limited perspectives on how to make effective 
organizational changes. In response to our July 2008 investigative report, 77 
DOD's former Comptroller/CFO and Defense Business Board (DBB) 
conducted reviews 78 of DCAA operations and made recommendations for 
corrective actions. The recommendations of the DBB are consistent with 
many of the recommendations discussed later in this report. DCAA has 
taken actions to revise performance metrics, change certain policy 
guidance, and obtain an independent organizational assessment (staff 
survey); however, DCAA has not yet addressed the fundamental 
weaknesses in its mission, strategic plan, audit approach, and human 
capital practices. Moreover, DCAA actions to date have focused on 



After we provided our report to DOD for comment, we received updated information on 
DCAA anonymous Web site complaints. As of the end of July 2009, DCAA had established 
209 cases. Eight of those cases were immediately referred to the DOD IG for investigation. 
Of the 209 cases, 82 were for the Western Region. 

77 GAO-08-857. 

' 8 Based on audit quality problems identified in our July 2008 report, in August 2008, the 
DOD Comptroller/CFO conducted a tiger team review in August 2008 and also asked the 
Secretary of Defense for support in conducting a study of DCAA. With the Secretary's 
approval, the DOD Advisory Panel determined that the Defense Business Board would 
perform this study. 
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process and have not addressed the agency's decentralized organizational 
structure that has fostered a culture of DCAA region autonomy. On 
October 23, 2008, the DBB discussed its preliminary findings and 
recommendations at a public meeting, and on January 22, 2009, the DBB 
released its DCAA study report, which concluded that: 

• DCAA's mission focused primarily on supporting the procurement 
community with no mention of protecting taxpayer interest. The 
current mission statement also provided for advisory services that 
raised serious questions about DCAA's independence and objectivity 
under GAGAS. 

• DCAA's strategic plan did not address essential elements required by 
GPRA, and it did not address emerging issues that could affect mission 
accomplishment or contain a human capital strategic plan despite 
spending 80 percent of its budget on personnel. 

• None of DCAA's 24 performance measures addressed audit quality, 
such as conformance to GAGAS, and only 8 could be tied to DCAA's 
strategic plan. 

• DCAA's decentralized organizational culture dilutes effectiveness of 
managerial oversight and affects GAGAS compliance and audit quality. 

• DCAA has not established a human capital strategic plan as a key tool 
to facilitate human capital management and workforce development in 
support of DCAA's mission and implementation of its strategic plan. 

The following discussion summarizes the status of DCAA corrective 
actions on identified weaknesses, including actions on key DBB and DOD 
Comptroller/CFO recommendations. 



DCAA's Mission Statement 
and Strategic Plan Have 
Not Yet Been Revised 



The DBB report, released in January 2009, pointed out that DCAA had five 
versions of a mission statement, noting that each version focused 
primarily on supporting the procurement community. The Board 
concluded that DCAA's mission should be refocused to protect the 
taxpayer's interests, writing: "The mission fostered the culture of 
supporting contracting officials, and the value system was one of quantity 
(number, cost, and timeliness of audits) over quality... which was further 
reinforced by the performance metrics that drove the organization." In 
addition, the Board reported that instead of complying with GPRA 
strategic planning requirements for long-term goals and objectives for 
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major operations and functions, DCAA's plan resembled a short-term 
process improvement checklist and did not address enterprise risk, 
external factors, or emerging issues that could affect mission 
accomplishment. In addition, the Board noted that DCAA's strategic plan 
did not include an adequate human capital strategy to facilitate workforce 
development, recruiting, retention, and succession planning. 

The Secretary of Defense Has The DBB report recommended that the Secretary of Defense revise 
Not Yet Developed a DCAA DCAA's mission to focus on protecting the interest of taxpayers, with the 

Mission Statement That taxpayer as the primary customer, and that DCAA establish a core value of 

Focuses on Protecting the performing high quality, independent, and objective contract audits that 

Public Interest adhere to GAGAS and ensure that taxpayer dollars are spent on fair and 

reasonable contract prices. The DBB did not address any amendments that 
might need to be made to the FAR, DFARS, and DOD Directives and policy 
documents that reflect DCAA's primary role as an advisor to government 
contracting officers and disbursing officers. 79 

Leading organizations that have undergone cultural and organizational 
transformation have identified top leadership involvement in developing a 
mission statement and strategic plan as a best practice. These 
organizations consider top leadership commitment in setting the direction, 
pace, and tone for the transformation as essential to provide a clear, 
consistent rationale that unites agency components behind the mission to 
guide the transformation. In meetings with DCAA officials, we expressed 
our concern that the Secretary of Defense had not taken action to revise 
DCAA's mission statement. On March 12, 2009, following a discussion on 
the preliminary results of our audit, the DCAA Director submitted a 
proposed revision to DCAA's mission statement to the Comptroller/CFO 
for review. The proposed revision inserted phrases that refer to ". . .serving 
the public interest" and ". . .ensure taxpayer dollars are spent on fair and 
reasonable contract prices." Although the revised mission statement had 
not been approved by the Secretary of Defense as of the end of July 2009, 
these changes would be positive. 



DCAA Has Not Yet Developed a The DBB also recommended that DCAA develop a strategic plan that 

Strategic Plan To Provide a cascades from the revised mission statement and concurrently develop (1) 

Framework for Organizational an annual performance operating plan and a balanced scorecard tied to 

and Cultural Reform the strategic plan and (2) a human capital strategic plan. In addition, the 



On most contracting matters with DCAA involvement, the cognizant agency contracting 
officer makes final decisions based on DCAA's findings and recommendations. 
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DBB recommended that DCAA obtain an independent assessment of 
resource needs and engage an external professional organization to assist 
in a cultural transformation. 

DCAA officials told us they are having difficulty identifying an 
independent external professional organization to assist the agency in 
developing a strategic plan because DCAA audits most of the organizations 
that should be able to provide this type of assistance. In her February 27, 
2009, response to the DBB report, the DCAA Director stated that DCAA 
expects to complete action on this recommendation by September 2009. 
With regard to the recommendation to develop a balanced score card, the 
DCAA Director reported that based on agreements with prior DOD 
Comptroller/CFOs, DCAA plans to use a monthly status report of agency 
performance measures rather than developing a balanced score card. 
Together with the change in performance measures for fiscal year 2009, 
DCAA implemented the monthly performance report in October 2008. The 
DCAA Director stated that DCAA will refine the annual performance plan 
in accordance with development of a revised strategic plan. 

The DCAA Director also stated that DCAA initiated a process to 
reengineer its human capital strategic plan in November 2008. The 
Director stated that DCAA obtained example plans from other 
organizations and attended training on human capital plan preparation and 
maintenance. DCAA is also seeking assistance from external organizations 
in reengineering its human capital plan. 



The Committee's September 2008 DCAA oversight hearing raised concerns 
that DCAA's performance metrics focused on producing reports rather 
than performing quality audits and that auditors who attempted to perform 
quality audits were penalized for not meeting production goals. The DCAA 
Director acknowledged problems with the agency's metrics and stated that 
she had initiated a project to assess the agency's use of performance 
measures that would be completed by September 30, 2008. Performance 
metrics provide the basis for measuring achievement of agency mission 
and strategic goals. Accordingly, performance measures should be 
consistent with agency strategic goals. Although DCAA's mission 
statement and strategic plan have not yet been revised to provide new 
goals, the DCAA Director took action in September 2008 to eliminate 
production-oriented performance measures. On September 30, 2008, the 
Director issued a policy memorandum that eliminated 18 performance 
measures, identified 9 performance measures with goals for use in fiscal 
year 2009, and clarified the use and level of reporting on the revised 



DCAA's Director Took 
Immediate Action To 
Eliminate Production 
Metrics, but Concerns 
about Audit Quality 
Measures Remain 
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measures. Some of the new performance metrics focus on outcomes, 
while others continue to focus on producing low cost audits in fixed time 
frames. 

New Performance Metrics Th e DOD Comptroller/CFO required DCAA to develop standard metrics to 

Intended To Focus on measure and re-enforce compliance with GAGAS and CAM across DCAA 

Achieving Quality Audits by February 28, 2009. The DCAA Director reported that the new metrics 

established on September 30, 2008, met this requirement. DCAA identified 
the following six new performance metrics as focusing on the intended 
outcome-related goal of achieving quality audits that comply with 
GAGAS. 80 

1. Obtaining an unqualified DOD IG peer review opinion. 

2. DCAA's internal quality assurance program results show that 100 
percent of the audits reviewed reflected professional judgment. 

3. Checklist confirmation that issued reports did not include serious 
deficiencies. 

4. A goal that 45 percent of audit reports will have findings as an 
indication of the tangible value of the audit work performed. 

5. A goal that 15 percent of the audits will use quantitative methods to 
measure the extent to which advanced level audit techniques are used. 

6. A goal that auditors will meet 100 percent of their continuing 
professional education requirements on time. 

Only metrics number 1, 3, and 6 have a direct relationship to audit quality. 
Although metric number 2 could improve audit quality if properly 
implemented, DCAA gave passing scores to deficient audits. Given the 
problems with DCAA's ineffective quality assurance program and DOD IG 
peer review results, for these three metrics to achieve the intended audit 
quality goal, significant changes will be needed in policy guidance and 
training on audit standards, appropriate procedures, and audit 
documentation in order to comply with GAGAS. The fourth goal that 45 
percent of DCAA audit reports will have findings is approximately the 
same as the actual percentage of 41 percent of the reports in 2008. 
Because findings would support recommendations for corrective action, 
this metric could contribute to improvements in accountability over 
contractor cost and billings. Regardless of the goal, findings should be 
reported as appropriate based on the completion of quality audits. Further, 
the use of quantitative methods of analysis in audit reports needs to be 



DCAA also established contracting officer sustention rates related to questioned cost and 
net savings as an informational goal to show return to the taxpayer. 
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supported by training on the appropriate methods for sampling and testing 
contract costs, controls, and compliance to help auditors perform 
sufficient testing to support audit conclusions and opinions. 

Performance Metrics That Although three of DCAA's fiscal year 2009 metrics are important in that 

Continue To Measure Output they address responsiveness to contracting officer requests for audits, if 

not properly managed, they could impact the effectiveness of DCAA's new 
audit quality metrics. In the past, DCAA's efforts to meet contracting 
officer requests for audits within specified time frames caused auditors to 
sacrifice audit quality. The following three performance metrics continue 
to address issuing reports within specified times to support contract 
awards and closeouts. 

• A forward-pricing audit timeliness goal of 95 percent based on 
agreement with requesters. 

• Incurred cost audit timeliness goals of 90 percent of corporate audits 
completed within 12 months, 90 percent of major contractor audits 
completed in 15 months, and 95 percent of non-major contractor audits 
completed in 24 months. 

• An efficiency goal of cost per direct audit hour of less than $113.45 to 
be monitored at the agency level only. 

It is critical that agreements with the contracting community on timeliness 
goals for forward-pricing and incurred cost audits allow performance of 
sufficient audit procedures to help contracting officers ensure that prices 
paid by the government are fair and reasonable, and that contract costs 
comply with applicable laws, regulations, cost accounting standards, and 
contract terms. In addition, keeping cost per direct audit hour in line with 
past practices indicates that DCAA likely would continue to use trainee or 
junior auditors on assignments without senior auditor or supervisory 
auditor involvement. GAGAS requires that staff assigned to perform the 
audit or attestation engagement must collectively possess adequate 
professional competence for the tasks required. 81 Moreover, DCAA has not 
agreed to develop a risk-based audit approach to address how it will 
perform required audits with available audit resources, reassess the need 
to perform 30,000 or more audits annually, and establish priorities for 
performing quality audits that meet GAGAS within available resources. 



GAO-07-731G, § 3.40. 
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On October 30, 2008, DCAA required regional audit managers to provide 
training on changes in performance metrics to all FAOs by December 31, 
2008, as part of the effort to get the word out that DCAA's mission should 
be to protect taxpayer interest and that auditors should perform quality 
audits that meet GAGAS. The DCAA Director stressed to us that budgeted 
audit hours would be captured for planning purposes, but they were never 
intended and should not have been used to evaluate auditor performance. 
The DCAA Director also told us that DCAA auditor performance 
appraisals should not have considered exceeding budgeted audit hours as 
a performance failure. In addition, DCAA implemented an anonymous Web 
site for capturing feedback on inappropriate use of the new performance 
measures and abusive management actions. 

Inconsistent Implementation During random telephone calls made to 17 auditors across 15 FAOs in the 
and Training on New Metrics f" lve DCAA regions, we found mixed results on FAO implementation of 

DCAA's new performance metrics. DCAA's Assistant Director of 
Operations told us she also had become aware of some problems with 
regional audit managers meeting the requirement to provide training to 
FAOs on implementation of the new DCAA performance metrics. The 
Operations Assistant Director told us that she planned to follow-up with 
all FAOs in this regard. In response to our telephone calls, for example: 

• Auditors at 13 of the FAOs told us that metrics related to meeting 
budget hours for completing audits have been relaxed. Although most 
of these auditors were not aware of audit completion dates in fiscal 
year 2009 program plans for their offices, two auditors told us that 
audit completion dates had been pushed back to allow more time for 
performing individual audits. An auditor at a Northeast Region FAO 
told us the use of budget hours was flexible before the metrics 
changes, so there was no noticeable difference. An auditor at a 
Western Region FAO said that although budget hours are no longer a 
metric for individual auditor performance, there is still a lot of pressure 
on auditors to meet budgeted hours. 

• Auditors at 5 of the 15 FAOs told us they had received the mandatory 
training on changes in performance metrics prior to December 31, 
2008. However, auditors at 4 FAOs told us they received the mandatory 
training after December 31, 2008, including two auditors at one Eastern 
Region FAO who told us they did not receive the required training until 
February 13, 2009. Auditors at the other 6 FAOs told us they received 
the metrics training, but they could not remember the dates of the 
training. 
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• Auditors at 5 FAOs told us they were permitted to charge from 1 to 2 
hours of administrative time per pay period for reading e-mails on 
DCAA policy changes and new policy memorandums. Auditors at 2 
FAOs said they were not given an administrative code for this purpose. 
One of these auditors told us they read the policies on their own time. 
Auditors at the remaining 8 FAOs did not mention a time limit for 
reading DCAA policy memoranda. DCAA headquarters officials told us 
that auditors should be permitted to charge administrative codes for 
this purpose and that they are working to resolve this issue across 
DCAA. 

The DCAA Director advised DCAA employees that the new performance 
metrics would be revisited after 6 months to determine if changes are 
needed. On February 11, 2009, DCAA revised its fiscal year 2009 job 
objectives/performance plans to reflect the new performance measures, 
and DCAA's Deputy Assistant Director of Operations advised us that 
DCAA initiated an assessment of the new performance metrics in April 
2009. 



DCAA Has Centralized, but 
Has Not Yet Restructured 
Its Audit Quality 
Assurance Program 



DCAA has taken some actions to improve its quality assurance program. 
However, staffing difficulties and other issues have left the outcome of this 
important initiative uncertain. As previously discussed, GAGAS require 
that each audit organization performing audits and attestation 
engagements in accordance with GAGAS should have a system of quality 
control that is designed to provide the audit organization with reasonable 
assurance that the organization and its personnel comply with 
professional standards and applicable legal and regulatory requirements, 
and have an external peer review at least once every 3 years. 82 In addition, 
considering the large number of DCAA audit reports issued annually and 
the reliance the contracting and finance communities have placed on 
DCAA audit conclusions and opinions, an effective quality assurance 
program is key to protecting the public interest. Such a program would 
report review findings along with recommendations for any needed 
corrective actions; provide training and additional policy guidance, as 
appropriate; and perform follow-up reviews to assure that corrective 
actions were taken. When we briefed DCAA on our preliminary findings in 
March 2009, DCAA had not yet taken action to correct serious deficiencies 
in its quality assurance program, including problems with DCAA's 
application of the professional judgment standard, whereby quality 



' GAO-07-731G, §§ 3.49-3.52. 
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assurance program officials gave satisfactory ratings when significant 
noncompliance with GAGAS had been identified by reviewers. 

In response to our previous report, on August 20, 2008, the DOD 
Comptroller/CFO required that DCAA take certain actions to improve 
audit quality, which included a restructuring of DCAA's quality assurance 
function. Accordingly, on August 22, 2008, DCAA established a new 
headquarters Directorate for Quality Assurance and Integrity, which 
centralized the quality assurance function at DCAA headquarters. The 
DOD Comptroller/CFO directed that the new Quality Assurance 
Directorate be headed by a Senior Executive Service (SES) Deputy 
Director. Because DOD did not grant DCAA an additional SES position for 
this purpose, the DCAA Director assigned responsibility for leading 
DCAA's quality assurance function to a level GS-15, Assistant Director for 
Integrity and Quality Assurance. Under DCAA's management environment 
and culture, which continue to foster autonomous regions headed by SES- 
level directors, the grade level and experience of the GS-15 equivalent 
Assistant Director for Integrity and Quality Assurance pose a challenge 
when dealing with SES-level regional directors, deputy directors, and 
regional audit managers. For example, when presented with our findings 
and conclusions that various audits did not comply with GAGAS, DCAA 
headquarters policy and quality assurance managers allowed regions and 
FAO's to decide whether to rescind the subject audit reports. In March 
2009, DCAA officials advised us that the GS-15, Assistant Director for 
Integrity and Quality Assurance position is an intended SES position and 
that two GS-15 Assistant Directors will perform as Chief of Integrity and 
Chief of Quality Assurance. 

In centralizing the quality assurance program, DCAA's new quality 
assurance organization provides for five GS-14 senior quality assurance 
auditors at DCAA headquarters and up to 27 GS-13 quality assurance 
auditors in the field assigned across the 5 DCAA regions. However, a 
headquarters requirement that all senior quality assurance staff relocate to 
DCAA headquarters at Fort Belvoir, Virginia, resulted in all but one of the 
five senior staff accepting other positions within DCAA because they did 
not wish to relocate. It took several months to recruit DCAA staff for the 
senior quality assurance positions at DCAA headquarters. On July 10, 2009, 
a DCAA headquarters official advised us that DCAA had selected staff to 
fill the two remaining vacancies, and these staff would be reporting for 
duty in the next few weeks. 

In response to our concerns that DCAA's quality assurance program has 
not resulted in audits that comply with GAGAS, DCAA officials advised us 
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that going forward, DCAA will no longer rate an FAO's overall compliance 
with GAGAS and DOD policy. The officials told us that instead, DCAA 
headquarters plans to (1) report the detailed results of the audit quality 
reviews, (2) make recommendations to FAOs for any needed corrective 
actions, (3) conduct follow-up reviews for all FAOs with identified audit 
deficiencies to ensure that corrective actions are taken, and (4) provide 
training and policy guidance, as appropriate. If properly implemented, 
these procedures would help to assure an effective audit quality assurance 
program. 



The DBB recommended that DCAA establish a risk-based planning 
process that expands DCAA self-initiated audits and increases the 
potential for identifying fraud, waste, and abuse, and higher rates of return 
to the taxpayer by April 2009. The DBB intended for DCAA to audit any 
and all contracts awarded by the department. On February 27, 2009, in 
responding to the DBB recommendation, the DCAA Director stated that 
(1) DCAA's practice of auditing only certain contracts was due to 
regulation or statute and (2) absent the DCAA access-to-records clause in 
certain types of contracts, DCAA has no legal basis to obtain cost data 
from a contractor. The DCAA Director suggested that the DBB 
recommendation should be directed to the Under Secretary for 
Acquisition, Technology and Logistics, who oversees DCMA, and not 
DCAA. The DCAA Director told us that she believes that DCMA should 
address this recommendation because DCMA decides what audits DCAA 
should perform to support contracting decisions and DCMA would need to 
initiate action to change audit-related FAR requirements. 

Generally, DCAA, as the agent of the Secretary of Defense, has authority 83 
to examine records of (1) a contractor performing any cost- 
reimbursement, incentive, time-and-materials, labor-hour, or price re- 
determinable contracts and subcontractors performing such contracts of 
the contractor and (2) to evaluate the accuracy, completeness, and 
currency of certified cost or pricing data required to be submitted 
pursuant to law, all records of the contractor or subcontractor related to 
the proposal, and discussions conducted on the proposal, pricing of the 
contract or subcontract or performance of the contract or subcontract. 
This authority is implemented by insertion of the Audit of Records clause 
in solicitations for negotiated contracts. 84 In addition, the Director of 



10 U.S.C. § 2313 and § 2306a. 
FAR §§ 52.214-26, 52.215-2. 



DCAA Disagrees with the 
DBB Recommendation for 
a Risk-Based Audit 
Planning Process 
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DCAA may require by subpoena the production of any records of a 
contractor that the Secretary of Defense is authorized to audit or examine. 
While DCAA does not have access to the records of all DOD contractors or 
statutory rights of access to contractor officials, we believe it has 
sufficient authority to undertake a risk-based audit approach consistent 
with its existing authority. Therefore, we believe the DBB 
recommendation for DCAA to develop a risk-based audit planning 
approach is appropriate. DOD acquisition officials we met with agree. 
Further, as previously discussed, a risk-based audit approach would 
provide a basis for determining audit resource requirements. 

DCAA has selected the Army Force Management Support Agency 85 to 
perform its staffing study. However, DCAA is conducting a staffing study 
as a stand-alone effort rather than performing the study in concert with an 
effort to establish a risk-based planning process. To provide useful 
information for decision making, it is important that the staffing study and 
risk-based audit planning approach are conducted as integrated efforts. It 
is also important for the DOD contracting and finance communities to be 
involved in the staffing study analysis and planning process because, as 
discussed earlier, a risk-based audit approach may require these 
communities to re-evaulate whether all DCAA services should be provided 
as audits and whether DCAA, as an independent audit organization, should 
perform any nonaudit services. 

To address immediate staffing needs, DCAA requested funds for additional 
audit staff and training from the Defense Acquisition Workforce 
Development Fund, 86 including 300 positions for fiscal year 2009 and 
another 200 positions in 2010. DCAA received approval of this request in 
December 2008. In May 2009, as part of DOD's request for an additional 
9,000 positions for contract management and oversight, the DCAA request 
was increased from 500 to 700 new positions that are to be phased in from 



85 The Army Force Management Support Agency's mission includes providing requirements 
studies and staffing analysis as well as determining whether organizations have the 
appropriate staff to carry out their mission. The Army Force Management Support Agency 
also provides services to DOD components. 

86 Pub. L. No. 110-181, §1705, 122 Stat. 3 (Jan. 28, 2008), the National Defense Authorization 
Act for Fiscal Year 2008, authorized the Secretary to establish the Department of Defense 
Acquisition Workforce Fund, in addition to other funds that may be available, for the 
recruitment, training, and retention of department acquisition personnel. The fund is 
managed by the Under Secretary of Defense for Acquisition, Technology, and Logistics. 
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fiscal year 2009 through 20 11. 87 As previously discussed, without 
developing a risk-based audit approach, it is difficult to determine the level 
of resources needed to perform effective, quality contract audits. 
However, federal acquisition and contract audit resources have not kept 
pace with the growth on federal procurements. As shown in figure 2, 
although procurement obligations related to greater reliance on 
contractor-provided services and support of the Global War on Terrorism 
have more than doubled since fiscal year 2002, DCAA audit resources have 
remained about the same. In addition, contractor and subcontractor 
relationships have become more complex, increasing the complexity of 
contract audits. These changes underscore the need for a risk-based audit 
plan and assessment of auditor resource and training needs. 



Figure 2: Comparison of DOD Contract Obligations and DCAA Workforce for Fiscal 
Years 2002 through 2008 
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Source: GAO analysis of unaudited obligations data from the Federal Procurement Data System and acquisition workforce data from 
the Office of Personnel M anagement 



According to a DOD Comptroller official, DCAA will receive an additional 300 positions 
in fiscal year 2009 and additional 200 positions in each of fiscal years 2010 and 2011. 
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Although DCAA has undertaken certain initiatives to improve the 
effectiveness of audits of contractor billings and internal control systems, 
these efforts are not targeted for completion until September 2010 and 
September 2012, respectively, and they are not part of a comprehensive 
audit strategy or framework. Once decisions are made on changes in 
various audit procedures for these audits, related audit guidance and 
training would be needed to help ensure the new procedures are 
effectively implemented. 



DCAA Issued Revised 
Policy Guidance To 
Address Auditor 
Independence, Assure 
Management Involvement 
in Key Decisions, and 
Address Audit Quality 
Issues 



Our investigation and audit identified problems and concerns related to 
auditor independence, the need for management involvement in key 
decisions, and audit quality. In response to our work, the DBB and DOD 
Comptroller/CFO made several recommendations for DCAA actions to 
address these concerns. Specific DCAA actions and our assessment 
include the following. 

Auditor independence. The DBB recommended that DCAA address 
advisory-type (nonaudit) services by (1) discontinuing participation on 
Integrated Product Teams and Source Selection Evaluation Boards, both 
of which impair auditor independence in fact and appearance under 
GAGAS; (2) reevaluating the role and number of Financial Liaison 
Advisors (FLA) to ensure independence and objectivity in both fact and 
appearance; and (3) working with the DOD acquisition leadership to 
explore alternatives for providing technical advice and support to the 
contract management community while adhering to the auditor 
independence standards in GAGAS. 

The DCAA Director responded that DCAA discontinued participation in 
Integrated Product Teams on August 4, 2008, and Source Selection 
Evaluation Boards on September 12, 2008. On November 23, 2008, DCAA 
realigned all FLAs to report directly to DCAA headquarters and completed 
an assessment of the number of advisors. DCAA is continuing to assess the 
functions performed by FLAs to assure their independence. The DCAA 
Director stated that if there is a significant change in the advisory 
functions, DCAA will initiate discussions with DOD acquisition leadership. 
We support efforts to reevaluate DCAA's nonaudit advisory services given 
the problems identified in our investigation. Although our review of 
DCAA's CAM guidance found that DCAA had established appropriate 
guidelines to avoid independence issues, we found that the auditors had 
not followed DCAA policy. According to the DCAA Director, the DBB's 
primary concern is that DCAA participation in these advisory services 
created the appearance of a lack of independence. 
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Requirement for DCAA management involvement in key decisions. 

DCAA issued policy memorandums requiring that (1) FAO managers sign 
all audit reports issued by the FAO; (2) auditors elevate memorandums on 
disagreements with supervisors and FAO managers on draft audit opinions 
to the highest level necessary, including the DCAA Director, for resolution; 
and (3) auditors elevate problems in accessing contractor records to FAO 
managers, contracting officers, and regional offices for appropriate 
handling. 

DCAA action to require FAO managers to sign all audit reports issued by 
the FAO addresses concerns identified in our investigation that 
supervisors could inappropriately issue reports with adequate ("clean") 
opinions without review by FAO managers. Similarly, the policy to elevate 
disagreements on changes to audit opinions responds to findings in our 
investigation that supervisors ignored auditors' objections to dropped 
findings and changed opinions, and the auditors had no opportunity to 
elevate their disagreement beyond the supervisors. The access-to-records 
policy clarified actions required when auditors are denied access to 
records and required FAO managers to brief their staff on the revised 
guidance. The revised policy guidance emphasized that auditors (1) should 
follow procedures for addressing denial of access to records, which 
include notifying the FAO manager, contracting officer, and DCAA region; 
(2) take appropriate actions to effect a suspension or withholding of any 
unsupported costs billed to the government until the data are received and 
a determination is made regarding the allowability of the costs; and (3) 
question the unsupported costs in the audit report if the supporting 
documentation is not received prior to the completion of fieldwork. 
Although our work identified some access-to-records problems, in these 
cases, there was no evidence that DCAA supervisors elevated the issue to 
management or to procurement officials to initiate enforcement action, as 
set out in existing DCAA policy. 

Guidance to improve audit quality. On August 6, 2008, the DCAA 
Director requested that each FAO hold a stand-down day (where staff 
were relieved of assigned duties to take mandatory training) to discuss 
audit quality and the requirement to comply with GAGAS requirements for 
competence, integrity, objectivity, and independence in performing 
contract audits. In addition, DCAA issued policy guidance on adequate 
audit documentation and testing, including the following guidance that 
applied to assignments we reviewed for this report: 

• "Workpaper Documentation of Judgmental Selections" — requires a 
description of the universe (population) from which items are selected 
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for testing, identification of items and attributes to be tested, and an 
explanation to support that the judgmental selection will result in 
adequate audit coverage. 

Emphasizing the requirement that audit documentation include a 
description of the population used for sampling and identification of 
items and attributes to be tested is appropriate. However, the 
requirement for an explanation in the audit documentation that the 
judgmental selection will result in adequate audit coverage needs to be 
sufficiently justified. GAGAS and AICPA standards require that 
auditors document significant decisions affecting the audit objectives, 
scope and methodology, findings, conclusions, and recommendations 
resulting from professional judgment. 88 

• "Audit Guidance for Annual Testing of Contractor Eligibility for Direct 
Bill," which is intended to determine whether continued reliance can 
be placed on the contractor's procedures for preparation of interim 
vouchers. This policy change clarified and consolidated audit steps 
related to the contractor's compliance with contract provisions, added 
audit steps for reviewing vouchers under time-and-material and labor- 
hour contracts, and removed the requirement to verify that the 
contractor's Central Contractor Registration is current. The policy 
memorandum states that this scope of work performed does not 
constitute an audit or attestation engagement under GAGAS. 

It is within DCAA's purview to determine whether these procedures 
constitute an audit. However, because direct-bill decisions present a 
risk of undetected improper contract payments, prudent decisions to 
continue a contractor's direct-bill authorization would necessarily be 
based on testing a statistical sample of invoices 89 and include a review 



88 GAO-07-731G, § 3.38 and AU § 339.12. 

89 Disbursing officers are authorized to make payments on the authority of a voucher 
certified by an authorized certifying officer, who is responsible for the legality, accuracy, 
and propriety of the payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000. 14-R, Department of 
Defense Financial Management Regulation (DFMR), Vol. 5, Ch. 11 (March 2009), paras. 
110102, 110203. In general, certifying officers designated in writing by the agency are 
financially liable for any improper, illegal, or incorrect payment made, and each payment 
made must be audited (or "examined"). 31 U.S.C. §§ 3521(a), 3528(a). DFMR, Vol. 5, Ch. 33 
(April 2005), para. 330303. However, 31 U.S.C. § 3521(b) authorizes heads of agencies to 
carry out a statistical sampling procedure, within certain parameters, to audit vouchers 
when the head of the agency determines that economies will result. Further, 31 U.S.C. § 
3521(c) provides that certifying and disbursing officials are not liable for payments that are 
not audited if they were made in good faith under a statistical sampling procedure. See 68 
Comp. Gen. 618 (1989); also see generally, GAO, Policy and Procedures Manual for 
Guidance of Federal Agencies, title 7, §§ 6.5, 7.4, and 7.5 (Washington, D.C.: May 18, 1993). 
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of supporting documentation, including documentation to confirm the 
government received goods and services noted on the billing invoice. 
We confirmed that Defense Finance and Accounting Service certifying 
officers rely on DCAA reviews, and they do not repeat review 
procedures they believe to be performed by DCAA. 



Human Capital 
Management and Cultural 
Transformation 



The DBB made two recommendations to improve DCAA human capital 
management and agency culture, namely that DCAA (1) develop a human 
capital strategic plan as a key tool to facilitate human capital management 
and workforce development and (2) engage an external professional 
organization to assist in a cultural transformation that includes 
emphasizing core values such as quality, independence, ethics, and 
objectivity rather than a mindset focused on quantity and productivity. 
DCAA has not yet developed a human capital strategic plan as a key tool 
to facilitate human capital management and workforce development. In 
May 2009, DCAA finalized an agreement with the Naval Post Graduate 
School, Center for Defense Reform, for assistance on cultural reform. 
According to GAO's Internal Control Standards, 90 operational success is 
possible only when the right personnel for the job are on board and are 
provided the right training, tools, structure, incentives, and 
responsibilities. Accordingly, management should ensure that skill needs 
are continually assessed and that the organization is able to obtain a 
workforce that has the required skills that match those necessary to 
achieve organizational goals. In addition, training should be aimed at 
developing and retaining employee skill levels to meet challenging 
organizational needs; qualified and continuous supervision should be 
provided to ensure that internal control objectives are achieved; and 
performance evaluation and feedback, supplemented by an effective 
reward system, should relate employee performance to the organization's 
success. 



Lack of a human capital strategic plan. The lack of a human capital 
management strategic plan has limited the effectiveness of DCAA's hiring, 
training, and staff development efforts. DCAA officials told us they view 
contract auditing as a highly specialized profession that requires 
knowledge of acquisition law and regulations and government 
procurement and contract management processes. As a result, DCAA 
officials believe that auditors must be hired at the entry level and trained 



' GAO/AIMD-00-21.3.1. 
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to perform contract audits. The officials also believe that because DCAA is 
the only contract audit agency in the federal government and it operates 
the only federal contract audit training institute, DCAA is in the best 
position to train contract auditors. However, DCAA is not the only agency 
that performs contract audits. Many IG offices, including the DOD IG, the 
military service audit agencies, several executive agency IGs, and GAO all 
perform contract audits. Further, DCAA has not provided training that is 
designed to develop contract audit skills at successively higher levels, and 
it has not provided adequate or continuous supervision of audit staff. 
Moreover, our work has shown that performance evaluations and 
feedback have not always related performance to the agency's success, as 
was the case when supervisors who were responsible for improperly 
dropping audit findings and changing draft audit opinions received high 
performance evaluations and cash awards. 

At the September 2008 hearing, the DCAA Director acknowledged the 
need to develop revised training to address audit quality issues. However, 
it will take considerable time to develop a revised training program to 
address the range of changes in audit policies, processes, and procedures 
for performing quality audits in accordance with GAGAS. However, on 
April 8, 2009, DCAA revised its Supervisory Development Training 
Curriculum to emphasize leadership skills and better reflect the day-to-day 
activities performed by supervisors. This revision was based on feedback 
received through DCAA's suggestion program, anonymous Web site 
contacts, and focus groups and is not based on a study or expertise of an 
outside professional organization. In addition, DCAA has begun a 
reassessment of the 2-week technical indoctrination class for new hires. 

Although it is appropriate to consider staff input in developing training 
courses, the development of in-house training by agency personnel may 
not result in a design that encourages participants to develop more critical 
analysis of the underlying principles or ways to bring about organizational 
change. Outside expertise helps ensure that an organization benefits from 
outside subject matter experts as well as education and training 
professionals who have a broad perspective on innovative approaches to 
best practices or best learning design. 

DCAA has difficulty identifying an independent professional 
organization to assist in cultural transformation. According to the 
DCAA Director, DCAA faces challenges in engaging a professional 
organization to assist with cultural change because (1) many external 
organizations that provide this service are audited by DCAA and to 
preserve the appearance of independence under the auditing standards, 
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DCAA cannot engage organizations that it audits and (2) based on initial 
discussions with various organizations, DCAA believes this effort could 
cost from $1 to $2 million or perhaps more and DCAA would need 
additional funding to pay for this assistance. However, based on an 
assumption that DCAA would receive funding for this effort, the Director 
established a completion date of January 2010 with training of the 
workforce potentially extending into fiscal years 2011 and 2012. In the face 
of these challenges, the DCAA Director took action on three other 
initiatives related to cultural change. The DCAA Director stated that 
shortly after issuance of our July 2008 report, DCAA initiated a 1- to 2-year 
project to accomplish an organizational assessment using the Baldrige 
National Quality Program 91 criteria with assistance from Baldrige experts 
within the Army. In addition, as required by the DOD Comptroller/CFO in 
September 2008, the Director asked the Office of Personnel Management 
to conduct an independent organizational survey of DCAA. As previously 
discussed, to help ensure that DCAA's new performance metrics resulted 
in appropriate cultural change with regard to the new emphasis on audit 
quality, DCAA established an anonymous Web site for obtaining feedback 
on the inappropriate use of the performance measures. 

In May 2009, DCAA asked the Naval Postgraduate School, Center for 
Defense Reform to assist DCAA with cultural transformation as 
recommended by the DBB. The Center began work in June 2009 to help 
DCAA identify issues facing the organization and develop an action plan. 

Delay in reporting results of DCAA's organizational survey. DCAA's 
independent organizational survey was completed during the fall of 2008, 
and DCAA officials said the assessment results would be finalized in 
March 2009, but then amended the date for completing the assessment of 
the survey results to late July 2009. Therefore, the survey results were not 
available to us for review. 

DCAA's anonymous Web site contacts underscore the need for a 
separate hotline office. DCAA's anonymous Web site was established as 
a mechanism for monitoring compliance with DCAA's new performance 
metrics; however, it has become an internal hotline, with many auditors 



The Baldrige National Quality Program is named for Malcolm Baldrige, a former 
Secretary of Commerce, who was a proponent of quality management as a key to national 
prosperity and long-term strength. The seven Baldrige performance excellence criteria are: 
leadership; strategic planning; customer and market focus; measurement, analysis, and 
knowledge management; workforce focus; process management; and results. 
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reporting the same issues as those presented in hotline complaints 
received by GAO. The DBB report stated that DCAA would benefit from 
the establishment of a Chief of Internal Review to perform critical 
inspector general functions, such as performing periodic reviews and 
evaluations, serving as an ombudsman between staff and DCAA 
management, and addressing hotline complaints. Instead of establishing a 
separate Internal Review function, in March of 2009, the DCAA Director 
divided responsibilities of its Operations Directorate between the 
Operations Assistant Director and Deputy Assistant Director to provide 
dedicated staff to handle auditor concerns reported to the internal DCAA 
anonymous Web site. DCAA's Assistant Director of Operations along with 
a Division Chief and three program managers were made responsible for 
the DCAA hotline function, and the Deputy Assistant Director of 
Operations was given responsibility for day-to-day operations. 

Our review of DCAA headquarters handling of DCAA auditor concerns and 
hotline allegations sent to DCAA's anonymous Web site determined that 
internally reported DCAA auditor concerns represent problems across all 
five DCAA regions. As with GAO hotline complaints, the largest number of 
problems reported to DCAA's anonymous Web site related to DCAA's 
Western Region. Our review of DCAA documentation and discussions with 
auditors and DCAA officials indicate that current handling of internally 
reported DCAA auditor concerns and allegations appears to be timely, 
objective, and fact-based. The Assistant Director of Operations has made 
good progress in establishing credibility and trust in the DCAA hotline 
function. It will be important for any future inspector general or 
ombudsman to carry forward in this role. The DCAA Director's response 
to the DBB report did not address the recommendation to establish a 
Chief of Internal Review. We agree with the DBB recommendation. It is 
important for DCAA to have a hotline function that is separate from 
management and operations. Currently, the Operations Assistant Director 
has been reassigned to handle this function on a temporary basis. 
However, given the size of the DCAA organization, the extensive number 
of internal DCAA hotline complaints — which totaled about 150 at the end 
of May 2009 — and the likelihood of continuing hotline contacts that would 
need to be addressed as DCAA undergoes its cultural transformation, a 
permanent internal review or inspector general function is warranted. 
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Legislative and Other 
Actions To Improve 
DCAA's Effectiveness 
and Independence 



In addition to correcting the fundamental weaknesses in mission and the 
overall management environment discussed above, certain legislative and 
other actions, such as changes in organizational placement, could enhance 
DCAA's effectiveness and independence. Successful management 
initiatives for cultural and organizational change in large private and 
public sector organizations can often take several years to accomplish. 
Changing DCAA's organizational placement without first correcting 
fundamental weaknesses in mission and the overall management 
environment would not assure effective audits. Given this time frame and 
pursuant to your request, we identified legislative and other actions that 
decision makers can consider to improve DCAA's effectiveness. In the 
short term, Congress could enhance DCAA's effectiveness and 
independence by granting DCAA certain authorities and protections 
similar to those offered to presidentially appointed inspectors general 
under the Inspector General Act of 1978, as amended 92 (IG Act). The IG 
Act contains provisions that enhance the independence of presidentially 
appointed IGs, including protections from removal without congressional 
notification, access to independent legal counsel, public reporting of audit 
results, rights to take statements from contractor and other personnel, and 
budget visibility. These provisions would enhance the important DCAA 
initiatives currently under way. Continued monitoring and oversight will 
be essential to assuring the successful implementation of DCAA's 
management initiatives. In the longer term, Congress could consider 
changes in organizational placement after current reform efforts have 
been effectively implemented. However, moving DCAA as an organization 
would require careful analysis and planning before implementation. 



Short-Term Legislative In addition to DCAA management reforms already under way and our 

Actions additional recommendations, we identified certain legislative protections 

and authorities under the IG Act that could enhance DCAA's effectiveness. 

Legislation would be needed in order to grant DCAA such protections and 

authorities. 

Leadership. The IG Act provides for the President to appoint the IG, with 
Senate confirmation, at many federal agencies. 93 Under the act, Congress 
must be notified in advance of removing the IG, and only Congress can 



92 Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

93 The IG Act also requires the heads of many "designated federal entities" to appoint an 
inspector general for each entity. 5 U.S.C. App. 8G. 



Page 61 



GAO-09-468 DCAA Audit Environment 



eliminate the office of an IG. Currently, the head of DCAA is appointed and 
can be removed by the Secretary of Defense. Further, DCAA was created 
and can be reorganized or reassigned by departmental order without 
notice. IG Act protections Congress could grant to DCAA would therefore 
include (1) Senate confirmation of a presidentially appointed DCAA 
Director 94 and (2) removal of the DCAA Director conditioned on 
congressional notification. 95 Specifically, the act provides that an 
inspector general may be removed from office by the President and any 
removal is to be reported to both Houses of Congress 30 days prior to the 
removal. In addition to these IG Act protections, Congress could build 
additional provisions into legislation, to include the following: 

• Requirements that the DCAA Director possess the appropriate 
professional qualifications. For example, provisions for appointment of 
the DCAA Director could require selection from among individuals 
who possess demonstrated ability in managing and leading 
organizations, specific accounting or auditing background, general 
knowledge of contract management, and knowledge of and extensive 
practical experience in financial management practices in large 
governmental or business entities. 

• A mandate permitting the DCAA Director to hold a renewable term 
appointment for between 5 to 7 years. Legislation should provide that 
the DCAA Director can be removed only for cause or other stated 
reasons. These protections would allow the head of DCAA to provide 
stability and continuity of leadership that span presidential 
administrations and prevent removal except for cause or other 
disclosed reasons. 

• Conflict of interest provisions for the DCAA Director and other key 
staff in addition to those provisions currently in law. This would be 
intended to ensure that selection of the audit agency head would not 
involve a "revolving door" situation between contractors and the 
contract audit agency. 

Access to independent legal counsel. The IG Act provides for 
independent legal advice for IGs rather than requiring the use of agency 



5 U.S.C. App. § 3(a). 
5 U.S.C. App. § 3(b). 
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legal counsel. 96 Currently, DCAA relies upon DOD legal counsel. DCAA 
officials told us that the DCAA Director has not always been apprised of 
legal decisions by DOD counsel that have impacted DCAA operations. 
Further, according to the DCAA Director, the lack of independent counsel 
led to a situation where DOD attorneys provided questionable legal 
counsel to a DCAA field office supervisor without the DCAA Director's 
knowledge. Obtaining independent legal counsel would avoid conflicts of 
interest between DOD and DCAA, thereby helping to improve DCAA's 
effectiveness. 

Budget. The IG Act requires separate budgets for Offices of Inspector 
General (OIG) within agency budgets, allowing Congress to review IG 
budget requests separately. DCAA currently does not have this protection. 
IGs that are appointed by the President with Senate confirmation receive a 
separate appropriation, preventing agencies from reprogramming IG funds 
to other programs and activities. However, there is currently little visibility 
of DCAA's budget because it is funded under the Operations and 
Maintenance, Defense-wide appropriation, which includes numerous DOD 
agencies, such as the Defense Contract Management Agency (DCMA), the 
Defense Logistics Agency, the Defense Finance and Accounting Service, 
and some buying command activities. Therefore, DCAA's share of annual 
appropriations is subject to reprogramming, sometimes without 
congressional notification. According to the DCAA Director and 
documentation provided by the Director and Office of Comptroller/CFO, 
in the past, DOD has reprogrammed funding between DCAA and other 
DOD activities on numerous occasions. Because these reprogrammings 
were below the $15 million threshold for congressional notification, 
Congress did not have notice of these funding decreases at the time they 
occurred. For fiscal year 2009, DOD reprogramming increased DCAA's 
funding by $3.5 million. Legislation similar to the IG Act could grant DCAA 
a separate budget 97 to provide visibility and protections from 
reprogramming of funds to other agency priorities. 

Increased authority and independence. Legislation could strengthen 
DCAA's audit authority by providing the same level of access to records 
and personnel available to IGs. 98 Currently, DCAA has statutory rights of 



5 U.S.C. App. § 8F(4)(A). 

5 U.S.C. App. § 6(f)(1). 

5 U.S.C. App. § 6(a)(1), (4), and (5). 
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access to certain records related to cost-type contracts or those that 
contain cost and pricing data, but not to contractor personnel. As a result, 
DCAA's subpoena power is limited to certain records and does not cover 
contractor personnel. While we recognize that DCAA auditors have 
ongoing discussions with contractor personnel, they do not have statutory 
authority to compel contractor officials to meet with them and submit to 
interviews. IGs have authority, including subpoena power, to access all 
records, reports, audits, reviews, documents, papers, recommendations, or 
other material available that relate to programs and operations for which 
the IG has responsibilities. Further, IG subpoena authority extends beyond 
access to records and documents in that IG auditors can administer or 
take an oath in order to obtain information. Our discussions with DCAA 
auditors and reviews of audit documentation identified numerous 
instances where requests for contractor records were not met." Obtaining 
increased access to contracting companies, especially their staff and 
documentation, would be an important provision to improve the 
effectiveness of DCAA audit staff. 

Reporting and oversight of audit results. The IG Act provides for 
semi-annual reports to the agency head and appropriate committees of 
Congress summarizing results of significant audits and investigations. 100 
DCAA currently has no external reporting requirement, reducing 
opportunities for oversight and transparency. Congress could mandate 
some form of external DCAA reporting in legislation similar to the IG Act. 
Moreover, DCAA does not currently provide copies of its audit reports to 
other federal agencies that use the same contractors that DOD uses. 
According to the DCAA Director, DCAA's appropriations are specific to 
DOD contractor audits, and unless federal agencies request and reimburse 
DCAA for audit services, DCAA cannot provide them with copies of its 
audit reports even though its DOD audits of systems and related internal 
controls, cost accounting system compliance, etc. may cover their 
contractors. Legislation could also expressly allow DCAA to provide audit 
results to other agencies, a step that would improve its visibility and 
effectiveness for the government as a whole. 



As noted previously, in these cases, there was no evidence that DCAA supervisors 
elevated the issue to management or to procurement officials to initiate enforcement 
action, as set out in DCAA policy. 

100 5 U.S.C. App. § 5(a). 
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Legislation to grant DCAA similar protections and authorities as those 
provided in the IG Act could enhance reform efforts that are already under 
way. Although we found that a lack of DOD Comptroller/CFO and IG 
oversight has impaired DCAA's effectiveness, DOD has begun work to 
provide improved oversight of DCAA's operations. In August 2008, the 
DOD Comptroller/CFO conducted a "tiger team" review of DCAA's audit 
quality assurance program, and DOD approved a more comprehensive 
Defense Business Board (DBB) study. The new DOD Comptroller/CFO 
recognized the need for DCAA oversight and on March 16, 2009, approved 
the charter for a DCAA Oversight Committee. Committee members include 
the Auditors General of the Army, the Navy, and the Air Force; the DOD 
Director of Defense Procurement and Acquisition Policy; and the DOD 
Deputy General Counsel for Acquisition and Technology. The Committee 
held its first meeting in early April 2009. During May 2009, the DCAA 
oversight committee members reviewed selected DCAA audits and visited 
a DCAA field office. In addition, the committee members have indicated 
that they plan to review this report, our earlier investigative report, the 
DOD Comptroller/CFO "tiger team" report, the DBB report, and the 
upcoming DOD IG report that follows up on issues from our July 2008 
report. The committee plans to assess DCAA actions on recommendations 
in these reports and identify any gaps for further action. We note that 
DCAA has already taken numerous actions to respond to our initial 
investigative report as well as DOD Comptroller/CFO and DBB 
recommendations. 



Long-Term Legislative Most of the impairments to DCAA effectiveness that we identified can be 

Actions To Move DCAA addressed within DCAA's current organizational placement. However, to 

address the Committee's interest in how changes in DCAA's organizational 
placement could improve DCAA effectiveness and independence, we 
considered potential approaches to moving DCAA. During the 1980s, there 
were numerous proposals to reorganize DCAA's organizational structure, 
including legislative proposals that would have placed DCAA in the Office 
of the Under Secretary of Defense (Acquisition), or in the DOD Office of 
Inspector General (OIG), or placed only DCAA's post-contract audits in 
the OIG. We analyzed these proposals in an April 1991 report 101 and 
concluded that they were not workable because they posed conflict of 
interest or duplication of effort issues. 



GAO, Defense Contract Audits: Current Organizational Relationships and 
Responsibilities, GAO/AFMD-91-14 (Washington, D.C.: Apr. 3, 1991). 
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We believe that it is prudent to consider changes in organizational 
placement after DCAA has had sufficient opportunity to effectively 
implement current reform efforts necessary to address fundamental 
operational issues. Legislation to move DCAA as an organization would 
require careful analysis and planning before implementation. Moving 
DCAA at this time would be a bold step with possible unintended 
consequences, and decision makers would need to carefully weigh the 
costs and benefits of moving DCAA before the fundamental operational 
issues are addressed. As discussed below, regardless of its ultimate 
placement in the government, DCAA still needs to address the 
fundamental weaknesses in its mission, strategic plan, metrics, audit 
approach, and human capital management. 

Elevating DCAA within DOD Elevating DCAA within DOD as a separate component reporting to the 

Deputy Secretary of Defense could give more authority to the DCAA 
Director and increase visibility of the organization both within and outside 
of DOD. 102 Because DOD positions reporting to the Secretary level are 
established by law, moving DCAA to the department level would require 
new legislation. To avoid any ambiguities or questions about whether the 
Secretary of Defense currently possesses the statutory authority to 
transfer the supervision of DCAA to the Deputy Secretary, we believe 
additional legislation that sets out appropriate relationships would be the 
best approach. 103 In addition, this option would require some level of 
administrative change. For example, management and oversight of the 
contract audit function would become the responsibility of Deputy 
Secretary, a separate appropriation would need to be established, and 
some form of periodic external reporting to Congress would be 
appropriate. We note that authorizing legislation to move DCAA could also 
include similar protections and authorities as those under the IG Act if 
these provisions have not already been enacted. 



The Deputy Secretary of Defense is appointed by the President after confirmation by the 
Senate. 10 U.S.C. § 132(a). Among other duties as assigned by the Secretary of Defense and 
in statute, the Deputy Secretary serves as the Chief Management Officer of the department 
with primary responsibility for "effectively and efficiently organizing] the business 
operations of the Department of Defense." Pub. L. No. 110-181, div A, title IX, § 904(a)(2) 
(Jan. 28, 2008). In that capacity, the Deputy Secretary is to be assisted by a Deputy Chief 
Management Officer, who also is appointed by the President after confirmation by the 
Senate, and who supervises the Defense Business Transformation Agency. 10 U.S.C. §§ 
132(c), 192(e). 

103 Current provisions of law relevant to the Secretary of Defense establishing and assigning 
defense agencies and defense field activities within the Office of the Secretary of Defense 
include 10 U.S.C. §§ 125(a), 131(b), 191(b), 192(a), and 194. 
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Although this option could enhance DCAA auditor objectivity and 
independence, under this organizational placement, DCAA would still 
need to resolve the management environment and cultural problems that 
have had a negative impact on audit quality, including pressure by 
contractors and contracting officers on audit scope and findings, 
conclusions, and recommendations. DCAA also would need DOD 
commitment to strengthening DCAA's contract audit function through 
continued monitoring and oversight. Leadership from the Deputy 
Secretary of Defense would be critical to help DCAA address these 
matters. A key factor will be whether the Deputy Secretary has the 
necessary time to focus on DCAA. The amount of time needed should be 
less once the fundamental improvements are accomplished. 

Establishing an Independent, Numerous governmentwide acquisition management reform efforts are 
Governmentwide Contract currently under way that could impact the contract audit function. These 

Audit Agency efforts include congressional oversight and reform legislation and 

Presidential direction on developing governmentwide guidance for 
reviews of existing contracts to identify contracts that are wasteful, 
inefficient, or otherwise unlikely to meet agencies' needs, and to formulate 
corrective action in a timely manner, as well as interest group studies. For 
example, in the National Defense Authorization Act for Fiscal Year 2008, 
Congress created the Commission on Wartime Contracting to study 
federal agency contracting for the reconstruction, logistical support of 
coalition forces, and the performance of security functions in Iraq and 
Afghanistan. The Senate Committee on Homeland Security and 
Governmental Affairs also recently created a new Subcommittee on 
Contracting Oversight. Several Members of the House Oversight and 
Government Reform Committee created the Clean Contracting Coalition 
to take a similar governmentwide approach. The House Oversight and 
Government Reform Committee also has been very active in this area. In 
addition, the House Armed Services Committee established an acquisition 
panel to evaluate DOD's current acquisition system, analyze the root 
causes of project or program failures, and the administrative and cultural 
pressures that acquisition and program personnel face. The House and 
Senate Armed Services Committees also led the effort to enact the 
Weapon Systems Acquisition Reform Act of 2009, 104 which requires 
oversight of cost estimation, systems engineering, and performance 
assessment; promotes competition; and limits organizational conflicts of 
interest. 



Pub. Law No. 111-23, 123 Stat. 1704, May 22, 2009. 
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On March 4, 2009, the President issued a memorandum directing executive 
agencies to (1) increase the use of fixed-price contracts, (2) enhance the 
capacity of the acquisition workforce, (3) maximize competition, and 
(4) rationalize the choice of government or contractor resources to 
perform required services. In addition, the Federal Acquisition Innovation 
and Reform Institute — a nonpartisan, nonprofit organization led by leaders 
in acquisition and supply management — has called for acquisition 
workforce reforms, including a single acquisition job series that 
encompasses at a minimum, three functions — program management, 
contracting, and a new function called requirements management — and is 
considered a professional "super COTR" (contracting officer's technical 
representative) position. Over the next several years, these reform 
initiatives likely will have a significant impact on government contracting, 
including the roles and relationships of contract auditors and the 
contracting, program, and finance communities. 

Depending on the outcome of the various contract reform initiatives and 
the successful implementation of DCAA management reforms, Congress 
may also want to consider increasing the efficacy of these reforms by 
establishing an independent governmentwide contract audit agency. The 
creation of a statutory governmentwide contract audit agency could 
enhance contract auditor effectiveness and independence by placing the 
audit agency outside DOD and other federal agencies that make 
procurement and contract management decisions. Centralizing the 
contract audit function and mandating its use by all federal agencies also 
could provide for consistent audit coverage and bring efficiencies and 
economies of scale to the contract audit process across the government. 
However, this would likely entail significant costs and operational and 
accountability considerations and would be an extremely costly option 
involving significant infrastructure and reorganization and would require 
substantial planning and analysis before deciding whether to proceed and 
how to implement any changes. Some of the issues that would need 
further study and analysis include the following: 

Governance. Governance is the framework of rules and practices by 
which a governing body, such as a board of directors, ensures 
accountability, fairness, and transparency in the entity's relationship with 
all of its stakeholders, including management, employees, and 
government. In order to improve governance and accountability at federal 
agencies, a variety of laws covering a range of management and 
administrative practices and processes have been enacted. Consideration 
of such provisions for a governmentwide contract audit agency should 
include application of general laws related to funds control, performance 



Page 68 



GAO-09-468 DCAA Audit Environment 



and financial reporting, accounting and internal control systems, human 
resources management, and recordkeeping and access to information, 
among others. Further, governance issues unique to a contract audit 
agency, such as its relationships to agency contracting officers and the 
Congress, should be assessed. 

Scope of Work. Scope of work considerations would include roles, 
responsibilities, and relationships of the governmentwide contract audit 
agency and IGs with regard to contract audits. Another consideration 
would be whether the new agency would be available for consultation as 
an outside expert on federal agency pre-award issues. In addition, a 
determination would need to be made on the handling of fraud referrals. 
For example, the central new agency could have an investigative division 
or it could refer potential contract fraud to federal agency IGs for further 
investigation. 

Funding. Congress would need to determine how to fund the new 
contract audit agency. For example, funding could be provided through 
appropriations or from reimbursement by federal agencies. This decision 
would likely be tied to decisions on the governmentwide contract audit 
agency's mandate and scope of work and any realignment of contract 
audit resources. 

Further study and analysis of this option would involve input from the 
federal agency IGs and agency contracting and finance communities as 
well as government contractors and public interest groups. Numerous 
additional issues would potentially be identified and require substantial 
time and cost for effective consideration and resolution. 



Successful accomplishment of DCAA reforms will require focused and 
committed leadership at the highest levels of DOD and DCAA as well as 
fundamental changes in DCAA's culture and possible congressional action. 
Without leadership commitment to a strong contract audit function and 
substantial changes to DCAA's mission, strategic plan, and management 
environment and culture, DCAA will continue to be challenged in its 
ability to perform quality audits that protect the public interest. Many 
needed changes are planned or under way and can be completed in the 
short-term, including revising DCAA's mission statement, strategic plan, 
and monitoring, and adjusting performance metrics. Fundamental 
structural and cultural changes related to developing and implementing a 
comprehensive, risk-based approach for contract audits that comply with 
professional auditing standards and identifying staffing, training, and 
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resource needs will take several years to accomplish and implement. 
However, unless the overall problems with DCAA's culture and 
management environment that resulted in pervasive contract audit failures 
are resolved, billions of taxpayer dollars will continue to be at risk for 
fraud, waste, abuse, and mismanagement. 



Recommendations for 
Executive Action 



We are making 15 recommendations to the Secretary of Defense to 
improve the quality of the agency's audits and strengthen auditor integrity, 
objectivity, and independence, including recommendations for actions on 
findings in this report that are aligned with certain Defense Business 
Board (DBB) findings and recommendations. 

First, we recommend that the Secretary of Defense revise DCAA's mission 
statement to reflect the need for quality contract audits and related 
nonaudit services that take into account serving the public interest. 



We also recommend that the Secretary of Defense require the Under 
Secretary of Defense (Comptroller/CFO) to establish milestones for 
completing DCAA corrective actions and monitor and regularly report on 
DCAA progress to assure timely completion of critical actions. 

In addition, we recommend that the Secretary of Defense direct the Under 
Secretary of Defense (Comptroller/CFO) to require the Director of the 
Defense Contract Audit Agency (DCAA) to take the following 13 actions. 

The following five recommendations cover actions to address our findings 
that are similar to DOD Comptroller/CFO and DBB findings. 

• In concert with the revised mission statement, develop a strategic plan 
with short-term and long-term outcome-related goals. 

• To measure progress in achieving strategic goals, ensure that metrics 
are tied to the revised mission statement and strategic plan and 
support the agency's annual work plan. 

• Consult with DOD stakeholders and engage outside experts to develop 
a risk-based contract audit approach that identifies resource 
requirements and focuses on performing quality audits that meet 
generally accepted government auditing standards (GAGAS). 



Page 70 



GAO-09-468 DCAA Audit Environment 



• Establish an SES-level position with responsibility for audit quality 
assurance that requires demonstrated knowledge and experience in 
applying professional audit standards. 

• Consistent with DBB report observations, establish a separate DCAA 
internal review organization to conduct critical internal inspector 
general functions, including performing periodic internal evaluations 
and reviews and addressing DCAA hotline complaints. 

The following eight recommendations relate to specific GAO findings in 
this report. 

• In consultation with DOD stakeholders, review DCAA's current 
portfolio of audit and nonaudit services to determine if any should be 
transferred or reassigned to another DOD agency or terminated in 
order for DCAA to comply with GAGAS integrity, objectivity, and 
independence requirements. 

• Based on the risk-based audit approach, develop a staffing plan that 
identifies auditor resource requirements as well as auditor skill levels 
and training needs. 

• Establish a position for an expert on auditing standards or consult with 
an outside expert on auditing standards to assist in revising contract 
audit policy, providing guidance on sampling and testing, and 
developing training on professional auditing standards. 

• Revise DCAA audit policy to provide appropriate guidance on what 
constitutes sufficient testing to comply with GAGAS. Update DCAA's 
Contract Audit Manual, as appropriate. 

• Develop agencywide training on government audit standards. This 
training should emphasize the level of assurance intended by the 
various types of engagements and provide detailed guidance on auditor 
independence, planning, fraud risk, level of testing, supervision, 
auditor judgment, audit documentation, and reporting. 

• Conduct a comprehensive, independent review of DCAA's revised audit 
quality assurance function. This review should focus on the consistent 
application of criteria used for assessing audit quality and assuring 
timely, consistent, and appropriate reporting of review results. 

• Make appropriate recommendations to address annual quality 
assurance review findings of serious deficiencies and GAGAS 
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noncompliance, provide training, and follow-up to assure that 
appropriate corrective actions have been taken. 

• Establish policies and procedures to ensure that auditors who make 
direct bill decisions are independent of DCAA employees who perform 
a DOD management function by reviewing vouchers of contractors not 
eligible for the direct billing program, thereby reducing situations 
where DCAA auditors are encouraged to reduce their office workload 
by approving contractors for the direct-bill program. 

Further, we recommend that the Department of Defense Inspector General 
take the following two actions. 

• Reconsider its overall conclusions in the May 2007 DOD IG report on 
the audit of DCAA's quality control system in which it reported an 
adequate ("clean") opinion on DCAA system of quality control in light 
of the serious deficiencies and findings included in that report and the 
additional evidence identified in our audit. 

• Based on the above, determine whether the report should be rescinded 
or modified. 



Matters for 

Congressional 

Consideration 



In addition to our recommendations to DOD for improving DCAA audit 
quality and auditor objectivity, integrity, and independence, Congress may 
wish to consider the following legislative actions for enhancing DCAA's 
effectiveness and independence. In considering these options, the 
Congress would need to weigh DCAA's ability to accomplish significant 
reforms within its current environment and the cost and administrative 
effort involved with the alternative options along with the potential 
benefits. Timing would also need to be considered, given significant 
reforms that DCAA is already undertaking and the additional burden that a 
change in organizational placement would add at this time. 



In the short term, as DCAA makes progress in correcting fundamental 
weaknesses that have impacted audit quality, Congress could consider 
enhancing DCAA reform efforts by enacting legislation to grant it 
protections and authorities similar to those embodied in the Inspector 
General Act, as amended. 



In the medium term, Congress could consider elevating the contract 
audit function within DOD by moving DCAA from under the DOD 
Comptroller/CFO and placing it under the Deputy Secretary of 
Defense. 
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• In the longer term, depending on the outcome of acquisition 

management reform initiatives under way and the success of DCAA 
management reforms, Congress could consider creating an 
independent, governmentwide contract audit agency. Legislation to 
move DCAA should incorporate the protections and authorities similar 
to those embodied in the Inspector General Act, if these have not 
already been granted to DCAA. 



Agency Comments 
and Our Evaluation 



We made a total of 17 recommendations, including 15 recommendations to 
DOD to improve DCAA's management environment, audit quality, and 
oversight; and we made 2 recommendations to the DOD IG regarding 
DCAA's last peer review. We received written comments from the 
Department of Defense (DOD) on September 8, 2009, and we received 
written comments from the DOD Inspector General (IG) on September 3, 
2009. DOD stated that the department concurs with all but one of our 15 
recommendations. DOD also stated that the Department and DCAA are 
committed to taking the necessary corrective actions to address our 
findings and that the department will continue to monitor DCAA to ensure 
timely completion of critical actions to address our recommendations. 
DOD also provided comments on our matters for congressional 
consideration. Although DOD disagreed with the matters we discussed, we 
continue to believe these are valid matters for congressional 
consideration. The DOD IG concurred with our recommendation to 
reconsider the conclusions in its May 2007 peer review report on DCAA; 
the IG did not concur with our recommendation to determine whether to 
rescind or modify its peer review report. DOD's written comments are 
reprinted in appendix IV, and the DOD IG's written comments are 
reprinted in appendix V. We summarize and evaluate the DOD and DOD IG 
comments and responses to our recommendations below. We made 
technical corrections and clarifications suggested by DOD in the body of 
our report, where appropriate. 



DOD Comments and Our DOD's written comments include (1) comments on our 15 
Response recommendations, (2) comments on matters we presented for 

congressional consideration, (3) a list of DCAA corrective actions, 
(4) DCAA clarifications, and (5) comments from the Director, Defense 
Procurement and Acquisition Policy. DOD officials fully concurred with 13 
of our 15 recommendations for improving DCAA audits, partially 
concurred on one recommendation, and did not concur with one 
recommendation. We view DOD comments as being generally responsive 
to the intent of our recommendations. Our discussion of DOD's response 
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to our matters discussion and our findings and recommendations follow. 
We provide additional comments on specific sections of the DOD response 
letter in appendix IV. 

With regard to the matters we presented for congressional consideration, 
DOD stated that it generally opposes providing DCAA with authorities 
similar to those contained in the Inspector General Act. DOD stated that it 
specifically opposes certain recommendations based on the IG model if 
DCAA remains within DOD, including (1) a Presidentially-appointed and 
Senate-confirmed DCAA Director, unless DCAA is independent of DOD, 
(2) fixed terms for the DCAA Director, (3) an independent budget, and (4) 
mandatory public reporting. DOD also stated that it plans to take steps to 
strengthen DCAA's independence by establishing an appeals process that 
permits DCAA to seek resolution when there are differences of opinion as 
to the resolution of its audit findings. Finally, DOD opposes moving DCAA 
from under the DOD Comptroller/CFO and placing it under the Deputy 
Secretary. DOD pointed out that the Deputy Secretary is the Chief 
Management Officer of one of the world's largest organizations and backs 
up the Secretary in the wartime chain of command, and he does not have 
the time to provide oversight and support to individual defense agencies. 

Although DOD did not agree with these matters, we believe they provide 
important information for Congress to consider. For example, the 
Inspector General Act provides many important authorities and 
protections for IG's that could enhance DCAA's independence and 
effectiveness. DOD disagreed with the Presidential appointment and 
Senate confirmation provision because it believes this would inject a 
political element into DCAA that is not appropriate and could create 
lengthy periods where there is no Director. DOD also opposes fixed terms 
for the DCAA Director because it believes the Secretary of Defense must 
have the ability to choose an appropriate Director. Our position with 
regard to appointments of IGs has been that Presidential appointments 
with Senate confirmation enhance their independence from the entities 
they audit and investigate. We recognize that DCAA serves a different role 
than IGs. We looked to the IG Act model to identify provisions that 
enhance the independence of auditors. A political appointment would 
elevate the status of the Director among DCAA's stakeholders and, as a 
consequence, give DCAA more authority to respond to actions taken by its 
stakeholders to influence its independent audit work. A fixed term would 
provide stability, especially during a time of organizational change. DOD 
also questioned the wisdom of an independent budget because it would 
limit its ability to move money into DCAA, as is occurring now based on 
funding from the Defense Acquisition Workforce Development Fund. 
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Separate appropriations are a key independence provision for IGs. The 
ability to reprogram funds within the Defense-wide Operations and 
Maintenance appropriation can involve both increases and decreases. Our 
analysis of DCAA reprogrammings over the last three years showed that 
funds were also moved from DCAA to other DOD organizations within the 
Defense- wide operations and maintenance appropriation. In DCAA's case, 
the reprogrammings to reduce funding generally related to large 
unobligated balances — showing that DCAA under executed its budget. We 
believe this is important information that Congress would want to know. 
Further, we do not see a reason why DOD could not receive approval to 
transfer funds to DCAA from another fund if it had a separate budget. For 
example, providing DCAA with funds from the Defense Acquisition 
Workforce Development Fund constitutes a transfer (not a 
reprogramming), the authority for which is provided in the legislation 
governing the Fund, 10 U.S.C. § 1705(e). DOD also opposed mandatory 
public reporting by DCAA. We believe that periodic reporting to Congress 
and the public on the results of DCAA's work will enhance accountability 
over DCAA. As discussed in our report, DCAA needs time to address the 
fundamental weaknesses in mission and the overall management 
environment. However, if DCAA is not successful in resolving these 
problems under its current organizational placement, it will be necessary 
to consider additional actions. In this regard, it may be worthwhile to 
consider elevating DCAA as a component agency reporting to the Deputy 
Secretary because this could enhance DCAA's independence by providing 
it more authority within DOD and increase DCAA's visibility both within 
and outside of DOD. 

DOD partially concurred with our recommendation that DCAA consult 
with DOD stakeholders and engage outside experts to develop a risk- 
based contract audit approach that identifies resource requirements and 
focuses on performing quality audits that meet GAGAS. DOD stated that 
DCAA already has a risk-based contract audit approach in identifying 
resource requirements and considers audit risk in planning various 
assignments. DOD stated that DCAA will coordinate with the Under 
Secretary of Defense for Acquisition, Technology, and Logistics (USD 
(AT&L)) to assess DCAA audit requirements. 105 DOD also noted that one of 
DCAA's cultural transformation projects is identifying and resolving 



1U!> The USD(AT&L) is responsible under 10 U.S.C. § 133 for establishing DOD policies 
related to the negotiation, award, and administration of contracts, such as those related to 
the use of contract audit services, and for coordinating contract audit activities within 
DOD. 
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differing stakeholder expectations while ensuring DCAA performs quality 
audits that meet GAGAS. DOD expects to complete its assessment of 
stakeholder needs based on regulatory and statutory requirements by 
December 2010. We appreciate these steps; however, we remain 
concerned that DCAA's current approach of performing 30,000 to 35,000 
audits and issuing over 22,000 audit reports with 3,600 auditors 
substantially contributed to the widespread audit quality problems we 
identified. Generating that many reports and doing that many audits with 
3,600 auditors leaves very little time to perform in-depth, complex audits 
of contractors. While the Director of Defense Procurement and Acquisition 
Policy commented that contract audits need to be completed "in time to be 
useful," to assure timely, quality audits, DCAA will need a risk-based 
approach to determine the appropriate level of audit and nonaudit effort 
and staffing. 

DOD did not concur on our recommendation to develop policies and 
procedures related to direct-billing decisions, stating that (1) the 
department believes that a review of the contractor's interim public 
vouchers is an integral function of DCAA's continual assessment of a 
contractor's billing system (2) DCAA is in the best position to review and 
approve contract interim billings based on its thorough understanding of 
the contractor's system, (3) DOD believes that our concerns are mitigated 
based on the comprehensive supervisory and audit manager reviews, and 
(4) DCAA does not believe that the approval of interim vouchers along 
with the approval for contractors to be on direct billing results in a lack of 
auditor objectivity. 

We continue to believe that DCAA's management (nonaudit) responsibility 
to perform prepayment reviews of contractor vouchers for DOD and the 
auditor's decision making role of approving contractors for direct billing 
privileges based on its audit conclusions about the strength of the 
contractor's system of internal controls, create audit objectivity issues. We 
revised our findings discussion and our recommendation to clarify this 
point. Under normal circumstances, DCAA must review contractor 
vouchers prior to payment — a management support function for DOD 
generally performed by DCAA field office administrative staff. By 
obtaining direct billing privileges, contractors can receive payment for 
goods and services without a voucher review by DCAA prior to payment. 
Because we found that this situation provides an incentive for DCAA to 
reduce its administrative workload by recommending that contractors are 
placed on direct billing, we recommended that DCAA develop new policies 
and procedures to ensure a separation between staff reviewing vouchers 
and staff making direct-bill decisions. In addition, DCAA has not explained 
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the basis for its belief that administrative staff have a thorough 
understanding of the contractors' systems. Further, we disagree with 
DOD's statement that our concerns are mitigated based on the 
comprehensive supervisory and audit manager reviews because this is not 
supported by our findings. The fact that DCAA approvals of contractor 
direct-bill privileges were not based on sufficient audit procedures as 
demonstrated by our work and DCAA's removal of over 200 contractors 
from the direct-bill program since our July 2008 report 106 support our 
concern that the existence of such an incentive presents an objectivity 
impairment. 

DOD provided additional comments on findings in its transmittal letter. 
DOD stated that it disagrees with the suggestion in our report that the 
department has not yet begun to address the weaknesses we identified. 
Our report neither states nor implies that DOD has not yet begun to take 
action. In fact, one of our objectives was to analyze steps DOD has taken 
so far, and our report describes in detail the progress made. Our report 
acknowledges that several positive steps have been taken by DCAA, but 
much more needs to be done to address the fundamental problems. Thus, 
solutions to the problems documented in this report will take time to first 
implement and then will have to be independently assessed to make sure 
they are effective. Our report also notes that fundamental changes have 
not taken place. For example, to date DOD has not revised DCAA's 
mission statement to reflect the need to consider the public interest as a 
key component of its work. In addition, DCAA has yet to assess the 
feasibility of 3,600 auditors issuing over 20,000 reports in one year (22,349 
in fiscal year 2008) and the appropriateness and need for the current 
combination of audit and non-audit services that drives this workload. 
Until these and other key steps are further along, it will be too early to 
assess whether DCAA has fundamentally changed or whether past 
practices continue. 

The DOD comments noted that one of our major findings is the lack of 
sufficient testing to support conclusions when giving an opinion on 
contractor internal control systems. The comments incorrectly refer to the 
requirement for sufficient testing as a GAO requirement and state that 
planned staffing increases may not be enough to accomplish audits 
required by regulation in light of additional testing stipulated by GAO. 
Professional audit standards have always required auditors to obtain 



GAO-08-857. 



Page 77 



GAO-09-468 DCAA Audit Environment 



sufficient evidence to provide a reasonable basis for the conclusion 
expressed in the report. As stated in our report, testing methodologies are 
a matter of professional judgment and can involve many factors. However, 
our findings reflect more than a difference of opinion with DCAA auditors 
on their exercise of professional judgment as reflected, in part, by the 
number of audit reports DCAA rescinded for insufficient testing. For 
example, we found insufficient documentation to support the 
methodology chosen and insufficient reasons for minimal testing, such as 
being told by a DCAA auditor that a "file size was too large" to test more 
than two recent vouchers. Again, DOD must address the feasibility of 3,600 
auditors issuing over 22,000 reports annually, most of which were 
reportedly performed under auditing standards. This may entail not only a 
risk-based audit approach but also exploring changes to the regulations 
that DOD represents require tens of thousands of these audits. 

DOD also disagreed with our position on the status of actions to 
strengthen DCAA's quality assurance program. DOD stated that DCAA has 
been proactive in standing up its new Integrity and Quality Assurance 
Directorate. DOD also stated that it believes the extensive overhaul of the 
quality assurance function accomplished in fiscal year 2009 will mitigate 
the prior shortcomings in audit quality that we cited. Although DOD's 
comments imply that DCAA has resolved its quality assurance problems, 
DCAA has acknowledged that it is not ready to undergo another peer 
review at this time. On September 1, 2009, we received a letter from the 
DCAA Director, stating that although improvements were put in place in 
fiscal year 2009, several significant improvements will be accomplished in 
fiscal year 2010. To allow sufficient time for DCAA to fully implement the 
necessary corrective actions, DCAA contacted us for guidance on (1) 
deferring its external quality control review for 2 years and (2) requesting 
that the next external peer review to cover assignments to be completed in 
fiscal year 2011. We agree with DCAA that it is not cost-effective to 
undergo an external peer review until an adequate system of quality 
control is in place. Expending substantial DOD IG resources when DCAA 
acknowledges that several years are necessary for improvements to be 
fully implemented is, in our view, an inefficient use of resources. DCAA 
has already begun to appropriately disclose in its reports that its audits do 
not comply with GAGAS external peer review requirements. 

The Director of Defense Procurement and Acquisition Policy (DPAP) 
provided additional comments. The Director stated that our report 
impugns DCAA's audits and that we adopt the position that because DCAA 
is serving the interests of contracting officers, DCAA is therefore not 
auditing in the interest of the public. The Director further asserts that 
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DCAA serves the public interest by providing useful and timely 
information to contacting officers, and that it is erroneous to imply that 
contracting officers do not seek to protect the public interest. Also, the 
Director states that GAO agrees with the Defense Business Board's 
recommendation to revise DCAA's mission to reflect a focus on the 
taxpayer as the primary customer. Finally, the Director suggests that our 
criticism of DCAA's "production-oriented auditing" sets up a dichotomy 
between quality and timely audits. We disagree with these 
characterizations of our report. 

DPAP's statements that our report impugns DCAA's audits and that we 
take the position that when DCAA is serving the interests of contracting 
officers, it is not auditing in the interest of the public relate to our 
summarization of the Defense Business Board (DBB) report and not our 
findings. Our report does not endorse the specific recommendations of the 
DBB to focus on the taxpayer as the primary customer. As our report 
points out, this recommendation does not take into account the regulatory 
and policy requirements that establish DCAA's primary role as an advisor 
to government contracting officers and disbursing officers. However, we 
agree with the DBB that DCAA should consider the public interest when 
carrying out GAGAS engagements. For audits and attestation engagements 
conducted under GAGAS, the auditor is expected to objectively and 
independently acquire and evaluate sufficient, appropriate evidence, and 
report on the results, consistent with the guidance in GAGAS. 107 GAGAS 
states the principle that "observing integrity, objectivity, and 
independence in discharging [auditors'] professional responsibilities 
assists auditors in meeting the principle of serving the public interest and 
honoring the public trust." 108 

DPAP also stated that the contracting officer is bound by regulation to 
meet the public interest in the broadest sense, for the entire matter 
surrounding a contract and that this includes factors other than DCAA 
audit findings and recommendations. As reflected in the extensive 
background discussion and elsewhere throughout our report, we 
recognize that contracting officers make final contracting decisions, and 
DCAA engagements support contracting officers in that process. Because 
we did not review the standards that contracting officers must follow, we 
did not include references to the requirements for contracting officers to 



See GAO-07-731G, § 1.03. 
GAO-07-731G, § 2.06. 
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protect the public interest in their actions. Our report also states that 
DCAA contract audit services are intended to be a key control to help 
assure that prices paid by the government for needed goods and services 
are fair and reasonable and that contractors are charging the government 
in accordance with applicable laws, regulations (e.g., Federal Acquisition 
Regulation (FAR) and Defense Federal Acquisition Supplement (DFARS), 
standards (e.g., Cost Accounting Standards (CAS)), and contract terms. In 
providing this assurance, DCAA audits would necessarily take into 
account serving the public interest. However, when DCAA audits do not 
meet GAGAS, they do not provide this assurance and thus are not serving 
the public interest. We found that DCAA auditors lacked objectivity and 
independence when performing GAGAS audits and engagements. In many 
cases, this was a result of auditors' focus on expediency to support client 
needs and, as the Director also observes, human capital shortages and 
poor management decisions. We do not question the need for contracting 
officers to use the services of advocates and assistants in carrying out 
their duties. However, when contract auditors represent that they are 
performing engagements under GAGAS, their primary focus should be on 
the integrity, objectivity, and independence of their work, which serves 
both contracting officers and the public interest. Further, the quality of 
DCAA audits impacts the quality of information available for contracting 
officer decisions. Whether DCAA can adhere to GAGAS on contract audits 
that provide minimal time to perform the work is a factor that USD 
(AT&L) should consider when establishing requirements for contract audit 
services. As we recommended, DOD should reconsider the mix of audit 
and non-audit services that it needs. 



DOD IG Comments and The DOD IG concurred with our recommendation to reconsider its overall 

Our Response conclusions in the May 2007 report on the audit of DCAA's quality control 

system in which it reported an adequate ("clean") opinion on DCAA's 
system of quality control in light of the serious deficiencies and findings 
included in that report and the additional evidence identified in our audit. 
The IG also stated that it did not concur with our recommendation to 
rescind the report and, because of that statement, we believe the IG 
misconstrued our recommendation as expressly calling for a rescission or 
modification of its peer review report. Our recommendation was for the IG 
to determine, based on the results of our recommended reconsideration of 
the IG's conclusions, whether it should rescind or modify the peer review 
report. 

The DOD IG also states that it took alternative action that conformed to 
the intent of our recommendation. The DOD IG comments state that it 
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notified DCAA on August 24, 2009, that the May 2007 "adequate" opinion 
on DCAA's system of quality control would expire on August 26, 2009. In 
addition, the IG stated, "We have determined that it is not prudent to allow 
the adequate opinion from our May 2007 report to carry forward." 
However, peer review opinions neither "expire" nor "carry forward" 
beyond the period covered by the peer review. Peer review opinions cover 
the period to which the opinion applied — in DCAA's case, as of the end of 
fiscal year 2006 — and the peer reviewed audit organization need not 
undergo another peer review during the next 2 years. 109 Because it has 
been more than 3 years since DCAA's last peer review, DCAA is no longer 
in compliance with the GAGAS requirement for an external peer review, 
and DCAA has taken appropriate action to disclose this noncompliance in 
its reports. 

As stated in our report, the overall conclusion in the DOD IG report is 
inconsistent with the detailed observations in its report, which indicate 
numerous significant deficiencies in DCAA's system of quality control. 
Further, based on DCAA's actions to rescind 80 audit reports, 39 of which 
were issued in fiscal year 2006 — the period on which the IG conclusions 
are based — and the findings in our audit, we concluded that DCAA's 
quality control system for the period covered by the DOD IG peer review 
was not effectively designed and implemented to provide assurance that 
DCAA and its personnel comply with professional standards. 



As agreed with your office, unless you publicly announce the contents of 
this report, we plan no further distribution for 30 days from the report 
date. At that time, we will send copies of this report to the Secretary of 
Defense; the Under Secretary of Defense (Comptroller/CFO); the Under 
Secretary of Defense for Acquisition, Technology, and Logistics; the DOD 
Director for Defense Procurement and Acquisition Policy; the Deputy 
General Counsel for Acquisition; the Secretary of the Army; the Secretary 
of the Navy; the Secretary of the Air Force; the Director of DCAA, the 
Director of DCMA; the DOD Inspector General; and the Director of the 
Office of Management and Budget. In addition, this report will be available 
at no charge on the GAO Web site at http://www.gao.gov. Contact points 
for our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. 



GAO-07-731G, § 3.55. 
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If you or your staff have any questions concerning this report, please 
contact me at (202) 512-7922 or kutzg@gao.gov or Gayle Fischer, Assistant 
Director, Financial Management and Assurance at (202) 512-9577 or 
fischerg@gao.gov. 




Gregory D. Kutz 
Managing Director 

Forensic Audits and Special Investigations 
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Appendix I: Internal Control System Audits 
Did Not Meet Professional Standards 



In performing its audits, the Defense Contract Audit Agency (DCAA) states 
that it follows generally accepted government auditing standards 
(GAGAS) 1 As part of our assessment of DCAA's overall management 
environment and quality assurance structure, we reviewed documentation 
for selected DCAA audits of contractor systems controls for compliance 
with GAGAS. We focused on internal control audits because contracting 
officers rely on DCAA audit opinions on contractor system controls for 3 
or more years to make decisions on pricing and contract awards and 
DCAA uses the audit opinions to assess risk when planning subsequent 
audits. We selected seven DCAA field audit offices (FAO) across the five 
DCAA regions that reported predominately adequate ("clean") opinions on 
contractor controls. For the seven FAOs, we reviewed 37 2 selected audits 
of contractor internal control systems, including accounting, estimating, 
billing, and indirect and other direct cost systems. As shown in table 5, we 
assessed these audits for compliance with eight key areas of GAGAS 
requirements: (1) auditor independence; 3 (2) adequate planning; (3) 
auditor understanding of controls; (4) design of procedures to detect risk 
of fraud, abuse, mismanagement, and contract terms; (5) documentation 
of sampling and testing; (6) audit evidence supports conclusions and 
opinion; (7) proper supervision; and (8) timely reporting and disclosures. 4 
We also considered GAGAS requirements for protecting the public interest 
when using auditor judgment. 6 As discussed in the body of this report, the 
37 audits we reviewed did not comply with GAGAS in one or more of these 
areas. However, we determined that 4 of the 37 audits included sufficient 
testing to support reported conclusions and opinions. Because the 
conclusions and opinions in the deficient audits were used to make risk 
assessments and determine the level of testing in other DCAA audits, such 
as annual audits of contract or incurred cost claims, audits of contract 
proposals and contractor forward pricing proposals, progress pay audits, 
and contract close-out audits, the audit quality issues related to the 



1 CAM 2-101(a) and 2-103c(l). 

2 We originally selected 39 internal control audits for our review. Because two audit 
assignments were performed as assist audits to an internal control audit in our selection, 
we considered these three assignments as one audit, and therefore, we reviewed a total of 
37 audits of contractor system internal control audits. 

3 GAO-03-673G, Chapter 3, especially §§ 3.03, 3.04, and 3.13-3.17. 

4 GAGAS for attestations audits related to requirements 2 through 8 are covered in 
GAO-03-673G, §§ 6.04a; 6.13-6.14; 6.24a & c; 6.15a, and 6.16-6.20; 6.02a, 6.04b, 6.22 and 6.24; 
and 6.28-6.54. 

5 GAO-03-673G, § 3.33-3.38. 
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GAGAS noncompliance we identified potentially impacts hundreds of 
other audits and contracting decisions covering billions of dollars in DOD 
expenditures. 



Table 5: GAGAS Noncompliance on 37 Selected Audits of Contractor Controls 



DCAA regions 


Reasons for GAGAS noncompliance 


Northeast 
(FAO #1) 


Mid-Atlantic 
(FAO #2) 


Eastern 
(FAO #3) 


Central 
(FAO #4 & 5) 


Western 
(FAOs #6 & 7) 


All 

regions 


Independence impairments 








1 


2 


4 


7 


Inadequate planning 





4 


1 


5 


7 


17 


Inadequate auditor understanding of controls 


1 


4 





2 


5 


12 


Lack of fraud risk detection procedures 


4 


5 


6 


11 


9 


35 


Insufficient documentation on sampling 
methodology 


3 


5 


6 


9 


4 


27 


Insufficient evidence to support conclusions and 
opinion 


3 


5 


6 


11 


8 


33 


Improper Supervision 








2 


5 


6 


13 


Reporting problems 


4 


5 


6 


12 


10 


37 


Total GAGAS noncompliance issues 


15 


28 


28 


57 


53 


181 


Number of audits 


4 


5 


6 


12 


10 


37 


Rescinded reports 


1 


3 


3 


7 


4 


18 



Source: GAO analysis of selected DCAA audits. 



Note: Because of the large size of the Central and Western regions, we tested audits at more than 
one field audit office in these regions. 

The following discussion includes examples of GAGAS noncompliance 
from specific audits we reviewed. 



Independence GAGAS state that the audit organization and the individual auditor should 

Impairments be free, both in fact and appearance, from personal, external, and 

organizational impairments to independence. 6 Our review of 37 audits of 
contractor internal controls found evidence in documentation for 7 audits 
that DCAA independence was compromised because auditors provided 
material nonaudit services to a contractor they later audited; experienced 
access-to-records problems that were not resolved; delayed report 
issuance, which allowed the contractor to resolve cited deficiencies, 



b GAO-03-673G, § 3.03, and GAO-07-731G, § 3.02. 
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without proper reporting; and performed test work on billings the 
contractor selected for testing. GAGAS state that auditors should be free 
from influences that restrict access to records or improperly modify audit 
scope. 7 GAGAS also state that audit organizations should not audit their 
own work or provide nonaudit services if the services are significant or 
material to the subject matter of the audit. 8 The following examples 
describe a situation where auditors assisted a Department of Defense 
(DOD) contractor in developing billing system policies and procedures 
after identifying five significant deficiencies and then reviewed their own 
work during a follow-up audit. 



DCAA Auditors Issued an Adequate Opinion on Controls They Helped Design 

DCAA auditors impaired their independence by performing nonaudit services for one of 
the top five DOD contractors in terms of dollars when they helped the contractor develop 
policies and procedures that were material to the billing system they were auditing. 

On May 12, 2005, DCAA reported an inadequate-in-part opinion on the contractor's 
billing system internal controls. The report included five significant deficiencies, including 
a failure to maintain current, adequate billing system policies and procedures. After 
issuing the report, DCAA auditors helped the contractor develop adequate policies and 
procedures related to accounts receivable, overpayments, and monitoring of the billing 
system before performing the required follow-up audit— an impairment to auditor 
independence. A year later, after performing the follow-up audit, DCAA auditors 
concluded that the contractor had performed adequate actions to correct all of the billing 
system deficiencies previously reported. On J une 28, 2006, DCAA reported an adequate 
opinion on the contractor's billing system internal controls. 

Following GAO's review of these audits, on March 6, 2009, DCAA rescinded the billing 
system audit follow-up report. 



We also noted instances of denials and limitations on access to records by 
contractors that were not handled properly. For example, during a billing 
system audit of one of the top five DOD contractors, an e-mail message 
documented in the audit workpapers showed that the auditors were 
challenged by a contractor official when they requested documentation to 
test whether billing clerks had received required training. The contractor's 
e-mail stated, "Here's a question for you. Can you tell me who and what 
requirement is making this part of the [audit]. This is a question that [is] 
being asked by [the Cash Manager]." The auditors eventually obtained 
limited training documentation from the contractor. Audit documentation 
and our interviews with the auditors revealed that the auditors also limited 



7 See GAO-03-673G, § 3.19 and GAO-07-731G, § 3.10. 

8 GAO-03-673G, §3.16. 
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testing in several other areas "because the contractor would not 
appreciate it." Access to records problems and strong external influence to 
limit testing are both impairments to independence according to GAGAS. 9 



Inadequate Planning GAGAS for attestation engagements state that the work shall be 

adequately planned. 10 Auditors should communicate information regarding 
the nature, timing, and extent of planned testing and reporting to officials 
of the audited entity and to the individuals contracting for or requesting 
the attestation engagement. Auditors should also plan work to follow up 
on actions to address significant findings and recommendations in 
previous audits and assess areas of risk in planning the engagement. 
However, our review of the audit documentation determined that 17 of the 
37 internal control audits we reviewed were not adequately planned. 

• In five audits, auditors failed to consider risk associated with new 
systems that had not yet been audited or systems that had not been 
audited in more than 4 years. These audits should have been ascribed a 
higher risk level according to DCAA CAM guidance and testing should 
have been increased. 11 DCAA has rescinded three of the five audits and 
is planning new audits, as appropriate. 

• Without documenting the basis for their decisions, auditors deleted 
audit steps from standard audit programs or did not perform all audit 
steps for three of seven audits we reviewed at one FAO. When we 
asked the auditors why they omitted key audit procedures in their 
work, the auditors told us they used "auditor judgment." However, the 
auditors would not explain the basis for their judgments to us or their 
rationale for omitting key procedures, such as assessing the 
contractor's control environment and testing the implementation of a 
contractor's policies and procedures. Because we did not find any 
justification for omitting key audit procedures in these three audits, we 
determined that they were inadequately planned. 

The following case discussion illustrates deficiencies in audit planning as 
well as a lack of auditor understanding of contractor processes and 
controls. 



See GAO-03-673G, § 3.19, and GAO-07-731G, § 3.10. 
1 GAO-03-673G, §§ 6.04a, 6.06, and 6.11. 
1 CAM 5-103. 
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DCAA Erroneously Performed an Audit over a Billing System That Did Not Exist 

In 2004, a Western Region FAO planned a billing system audit of a federally funded 
research and development center (grantee) that receives $1.5 billion annually for 
research services. However, the planning for this billing system audit did not take into 
account the fact that grantees are funded through letters of credit and do not actually 
bill the government. This financial relationship is very different— and much less 
complicated— than a situation where a contractor bills the government for contract costs 
in accordance with Cost Accounting Standards and the Federal Acquisition Regulation. 
For example, under a letter of credit financing arrangement, grantees draw funds as 
disbursements are made and are required to prepare reports of transactions on their 
use of the funds and submit them to the funding agency. Despite this obvious mistake, 
on May 6, 2005, DCAA auditors issued a report stating that the grantee had an 
"adequate billing system." 

Another report issued by the same DCAA office on J une 25, 2004, reviewed the 
grantee's cash management practices under the Single Audit Act for another federal 
agency. The auditors could have simply forwarded this report to the DOD contracting 
officer— a task that would take an hour at the most to complete. Instead, DCAA auditors 
charged over 530 staff hours to generate documentation to meet DCAA's billing system 
audit requirements, even though there was no related "billing system." As a result of our 
review, DCAA reassessed the need to perform a billing system audit for the grantee 
and determined that it would rely on the Single Audit Act reports in the future. DCAA 
has not rescinded the audit report even though it expresses an opinion on a nonexistent 
system. 



Auditors Did Not Properly 
Document Understanding 
of Controls for Several 
Audits 



GAGAS require that in planning examination-level attestation 
engagements, auditors should obtain a sufficient understanding of internal 
control that is material to the subject matter and design procedures to 
achieve the objectives of the audit. 12 The subject matter or assertion the 
auditor is testing may relate to the effectiveness and efficiency of 
operations, including the use of an entity's resources; the reliability of 
financial reporting, including reports on budget execution and other 
reports for internal and external use; compliance with applicable laws and 
regulations, provisions of contract, or grant agreements; and safeguarding 
of assets. 13 Although most of the 37 internal control audits we reviewed 
met this standard, 12 audits did not. The following case study shows an 
example of insufficient understanding of controls. 



On five audits, auditors overstated the strength of the contractor's 
control environment in the audit documentation and used this 
information to justify performing little or no testing of controls for 



' GAO-03-673G, §§6.13-6.14. 



1 GAO-03-673G, §§6.13 and 6.14. 
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accounting and billing system control audits. On two of the five audits, 
a Mid-Atlantic Region auditor admitted that he included inaccurate 
statements in the audit documentation. These statements indicated 
that the contractor performed internal audits and had a formal 
management-level monitoring process over accounting and billing 
functions. When we requested copies of the internal audits and 
management reviews, the auditor admitted that these statements were 
not true and that he had made "mistakes." He entered the factually 
incorrect information in the audit documentation to justify performing 
little or no testing. The auditor was a GS-13 technical specialist who 
reviewed the work of other auditors and provided them audit guidance. 
DCAA has rescinded four of the five audits and is planning or initiating 
new audits. 

• On another audit involving a business segment of a third contractor of 
the top 5 DOD contractors, auditors did not consider the contractor's 
control environment in planning an audit of a new accounting 
system — a significant factor that resulted in insufficient testing. 
Further, after identifying significant accounting system deficiencies, 
including that certain contract costs are manually processed, are not 
processed timely, or are not adequately reconciled to actual incurred 
costs, the auditors delayed issuance of the audit report for about 16 
months, waiting to see if the contractor would take corrective actions 
on the identified deficiencies. Although test procedures were applied 
from February 25, 2004, to September 15, 2004, DCAA reported an 
"inadequate-in-part" opinion on the contractor's accounting system on 
March 14, 2006 — nearly 1-1/2 years later, without performing any 
additional testing. Following discussions with GAO, DCAA rescinded 
this audit report on November 20, 2008. 

In the audit described below, the auditor relied on the contractor to 
document the auditor's understanding of controls. 
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DCAA Auditors Relied on the Contractor to Document Internal Controls without 
Testing the Accuracy of the Documentation 

This case involves a billing system audit DCAA conducted in 2006. The last time DCAA 
had tested the billing system for this contractor was in 2000— a clear indication that new 
tests should be performed. At that time, DCAA's CAM required that contractor internal 
control systems be audited every 2 to 4 years. However, rather than re-testing the 
billing system, DCAA auditors provided the contractor's Information Systems Manager 
with 6-year-old documentation obtained during a DCAA auditor's walkthrough of the 
billing process in the prior audit. The DCAA auditors asked the Information Systems 
Manager to update the documentation by making edits where necessary. According to 
the audit workpapers, the 6-year-old documentation was "edited by the contractor" and 
provided back to the DCAA auditor. Based on the contractor's documentation of the 
billing system internal controls, the auditor concluded "we can limit our testing of 
management reviews, policies and procedures, and implementation of policies and 
procedures. "The auditor then traced one paid voucher through the billing process. This 
procedure relates to determining whether the auditor's understanding of the process is 
correct and is not substantive testing (i.e., detailed tests of transactions and balances 
and analytical review procedures.) 

The auditor told G AO that she used this "low-risk approach" because she felt that the 
contractor's system was "strong" and did not warrant a higher risk approach. However, 
according to the documentation GAO reviewed, the billing system was a software 
package that downloads accounting system data to spreadsheets. Manual calculations 
were then used to develop invoice amounts— a process that is prone to errors and does 
not provide assurance of consistent systematic processing of invoices. Further, since 
DCAA's earlier walkthrough in 2000, the contractor had experienced significant 
downsizing and restructuring. 

The auditor performed no testing of the contractor's billing system controls in order to 
determine whether the system was operating effectively at the time of the audit. The 
audit report that was issued onj une 21, 2006, with an adequate opinion was not based 
on sufficient audit procedures to provide assurance over approximately $76 million in 
sales to the government. After GAO raised concerns about this audit, DCAA rescinded 
the audit report on March 3, 2009. 



Failure to Design and 
Perform Procedures to 
Detect Fraud Risk 



For DCAA examination-level attestation audits of contractor controls that 
we reviewed, GAGAS requires auditors to design and perform audit steps 
to obtain reasonable assurance of detecting fraud, illegal acts, or 
violations of provisions of contracts that could have a material effect on 
the subject matter of the engagement or internal control. 14 DCAA 
management asserts that its examination-level audits are designed to 
provide this assurance, and DCAA internal guidance requires auditors to 
consider a list of fraud indicators included in DCAA's CAM 15 or the DOD 



GAO-03-673G, §6. 15a. 
CAM, Figure 4-7-3. 
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Inspector General's Handbook on Fraud Indicators 16 in planning and 
performing their work. However, for 35 of the 37 internal control audits 
we reviewed there was no evidence that DCAA auditors designed specific 
procedures to identify risk of fraud, illegal acts, violations of contract 
terms, or other improprieties. Further, our analysis of audit workpapers 
showed that DCAA auditors lacked an understanding of fraud indicators 
associated with weak internal controls. For example, although segregation 
of duties is a key fraud-prevention control, in the seven audits where 
workpapers identified segregation of duties issues, the auditors did not 
consider a lack of segregation of duties to be a fraud risk in 6 of the audits. 
The auditors did not look for a compensating control or perform 
additional procedures to determine whether the lack of segregation of 
duties had allowed fraud to occur. Occurrences of duplicate invoices also 
would increase the risk of fraud. However, DCAA's audit program for 
testing contractor billing system controls does not include specific 
procedures to test for duplicate contractor invoices. We found evidence of 
testing related to duplicate invoices in only 2 of the 37 internal control 
audits we reviewed. Moreover, in the audit described below, DCAA FAO 
managers ordered an auditor to ignore significant fraud risks during an 
audit. 



DCAA FAO and Region Management Prevented an Auditor from Pursuing 
Significant Fraud Risks during a Billing System Audit 

During a fiscal year 2003 incurred cost audit of a major defense contractor, a DCAA 
Central Region auditor learned of a fraud investigation initiated by the Army's Criminal 
Investigative Division (CID) in response to allegations of contractor fraud reported in 
August 2002. In J uly 2004, during a billing system audit of the same contractor, the 
auditor contacted the Army CID investigator to discuss the ongoing fraud investigation 
and learned that the fraud related to improper billings. As a result of this elevated fraud 
risk, the auditor requested several nominal increases in budget hours to perform 
additional testing to determine the extent of the fraud. The auditor had prior DOD 
contract administration experience and intended to use this experience in applying her 
audit testing procedures. After approving increases in budgeted hours for this 
assignment, the regional audit manager told the auditor that her concerns were not 
valid and to remove her "contracting hat." 

Eight months later, on April 28, 2005, the auditor submitted a draft audit report to her 
supervisor. She concluded thatthe contractor's billing system was inadequate— a 
finding that would have resulted in the contractor losing its direct-billing privileges. The 
auditor noted several deficiencies and concerns, including (1) the lack of billing policies 
and procedures, (2) a lack of training for contractor employees responsible for 
preparing invoices, (3) indications thatthe contractor may have billed the government 
for unapproved and unfunded work, and (4) evidence of an ongoing criminal 



DOD Inspector General, Handbook on Fraud Indicators for Contract Auditors, Section 
II.4 (IGDH 7600.3 APO, March 31, 1993). 
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investigation by the Army CID. After reviewing the report, the supervisor and FAO 
manager directed the auditor to change the opinion from inadequate to inadequate-in- 
part because the auditor had not identified any excess or unallowable costs. The audit 
report, issued on August 31, 2005, reported an inadequate-in-part opinion and 
combined the first two deficiencies, reporting a total of three significant deficiencies. 
However, DCAA did not remove the contractor from the direct-bill program, whereby 
contractors are authorized to submit invoices directly to a government paying office 
without prior review. 

The auditor assigned to the original audit was also assigned to the billing system follow- 
up audit, but she was subsequently removed from the follow-up audit because, 
according to her supervisor, she was documenting her audit in too much detail. In 
J anuary 2006, during the follow-up audit, Army CID concluded its fraud investigation. 
The contracting officer's technical representative (COTR) and several contractor 
employees were convicted of fraudulently billing the government using the billing 
system that DCAA later deemed adequate. The investigation found that the COTR and 
the contractor employees were charging the government for travel to contract-related 
conferences and arranging the trips so they could attend a NASCAR race at 
government expense. They took government cars on the trips and various contractor 
employees each charged the government for use of their personal cars, with the COTR 
approving the travel vouchers. In addition, the COTR had contractor employees cut 
scrap lumber on government land and stack it at his home for use as firewood. The 
government was billed forthe contractor employees' time on behalf of the COTR. In the 
J anuary 2006 settlement, which totaled over $2.8 million, the COTR and contractor 
employees paid fines and restitution, and the COTR also served jail time. 

The Army CID Special Agent in charge of the fraud investigation told us that he had 
tried on numerous occasions to get the DCAA FAO manager to stop issuing incurred 
cost audit reports with "clean" opinions because the opinions would be contradicted by 
the findings in the ongoing fraud investigation. The FAO issued the 2002 incurred cost 
audit report on J anuary 5, 2005, stating its opinion that except for the qualification that 
the ongoing fraud investigation had developed information which may impact the costs 
and transactions in this report, the claimed direct costs are acceptable and are 
provisionally approved, pending final acceptance. DCAA did not include a cautionary 
note or similar qualification in the billing system audit report. In September 2006, DCAA 
reported an adequate ("clean") opinion in the follow-up audit report on the contractor's 
billing system controls without performing work to confirm that the contractor's billing 
system policies and procedures were effectively implemented. 

Following GAO's review of these audits, on November 20, 2008, DCAA rescinded both 
reports because the audit documentation did not support the reported opinions and 
initiated a new audit of the contractor's billing system controls. 



Insufficient 
Documentation of 
Sampling and Testing 
Methodology 



Testing is a critical auditing procedure that allows auditors to determine 
whether controls are operating effectively. Although some testing can 
involve statistical samples, such samples are not required under GAGAS. 
Instead, GAGAS require that auditors prepare attest documentation in 
sufficient detail to enable an experienced auditor, having no previous 
connection to the audit, to ascertain from the attest documentation that 
the evidence supports the auditors' significant judgments and conclusions. 
Under GAGAS, attest documentation should contain the objectives, scope, 
and methodology of the attestation engagement, including any sampling 
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and other selection criteria used. 17 Of the 37 internal control audits we 
reviewed, 27 audits did not contain workpaper documentation to 
demonstrate that the auditors' nonstatistical samples met these 
requirements, for example: 

• On one billing system audit, the auditor performed testing on two 
vouchers. The auditor did not document how he selected the two 
vouchers, and he did not document the population of contractor 
vouchers in the workpapers or the basis for his judgment on selecting 
the two vouchers for testing. When we asked the auditor why he 
selected two most recent vouchers for testing and did not document 
the voucher population, the auditor told us it was because "the file size 
was too large," and he saves the population files on his desktop 
computer. 

• On a billing system audit of one of the five largest DOD contractors we 
asked the auditor why he tested only one voucher to assess the 
contractor's controls for subcontractor accounting and billing. The 
auditor said this was reasonable because DCAA "had tested so many 
vouchers before." Other workpaper documentation noted testing was 
not performed on the direct-bill section of the audit program. When we 
asked the auditor why these procedures were not performed, the 
auditor told us that testing was performed by another FAO when the 
contractor implemented a new system 2 months earlier, and he decided 
not to do testing again because "the contractor would not appreciate 
it" — an indication of an auditor independence problem. Moreover, tests 
of new billing systems focus on data processing controls and would not 
take the place of tests of invoices for compliance with CAS, FAR, and 
contract terms. 

Although the CAM includes guidance on sufficient testing, 18 auditors 
appeared to follow general guidance throughout the manual that advises 
auditors to use their judgment "to 'test check' a procedure, to make 
verifications 'on a selective basis,' or to review a 'representative number' 
of transactions or items." Several auditors, field office managers, and 
DCAA headquarters officials told us that they believed "spot checks" were 
sufficient testing to conclude on controls overall and they did not believe 
they were required to document their sampling plans. 



GAO-03-673G, §§ 6.04b, 6.22, and 6.24a. 
CAM 4-600 and Appendix B. 
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DCAA Relied on Faulty Auditor Judgment to Approve Contractor Controls 

An Eastern Region auditor performed minimal testing in an audit of controls over 
indirect and other direct cost for a business segment of one of the top five DOD 
contractors that billed the government for about $1 billion during 2006. The auditor did 
not use statistical sampling or test a representative selection of accounts payable 
transactions. Instead, without documenting the reasons for his judgments, the auditor 
tested 6 of 16,000 accounts payable transactions ($86 of $50 million), 3 of 4,500 travel 
transactions ($2,700 of $15 million), and 3 of 1,600 interdivisional transactions ($5,000 
of $16 million). On September 27, 2006, DCAA reported an adequate opinion on the 
contractor's controls over direct and indirect costs. However our review of the audit 
workpapers revealed 

no explanation of why so few transactions were tested, 

no rationale for why transactions selected for testing covered the months of May 
through J uly 2005, when transactions occurred throughout the year, or 

how the auditor concluded that the system was adequate based on testing 12 out 
of about 22,000 transactions. 

When we asked the auditors to explain the basis for their selection of transactions used 
for testing, FAO management said the selection was based on auditor judgment; 
implying auditors could use their professional judgment without the need to meet any 
specific criteria in doing so. GAGAS section 3.34 (GAO-03-673G) states that auditors 
should consider the need to protect the public interest when making professional 
judgments. GAGAS section 6.02a requires auditors to perform sufficient testing to 
support audit conclusions and opinions on controls. Determining what is sufficient 
testing requires auditors to determine an appropriate sample size considering risks, 
expectation of misstatements or deviations, and materiality, and select a representative 
sample from the population, meaning that all transactions have a known chance of 
being selected. GAGAS section 6.24 a. and c. require auditors to document the 
sampling plan and auditor judgments made in sampling and testing. This audit did not 
meet these GAGAS requirements. 



Insufficient Evidence to 
Support Audit Conclusions 
and Opinions 



We found that audit procedures for most of the 37 internal control audits 
we reviewed documented the design of controls but did not test the 
implementation of controls. As a result, the audits lacked sufficient 
evidence to support audit opinions that covered both the design and 
implementation of controls. GAGAS for examination-level attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the report. 19 
GAGAS state that attest documentation serves to (1) provide the principal 
support for the auditor's report, (2) aid auditors in conducting and 
supervising the attestation engagement, and (3) allow for the review of the 
quality of the attestation engagement. The preparation of attest 
documentation should be appropriately detailed to provide a clear 



GAO-03-673G, §6.04b. 
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understanding of its purpose and source and the conclusions the auditors 
reached, and it should be appropriately organized to provide a clear link to 
the findings, conclusions, and recommendations contained in the auditors' 
report. 20 

Overall, we found that 33 of the 37 internal control audits did not include 
sufficient testing of internal controls to support auditor conclusions and 
opinions. Our review of audit workpapers often found that only two, three, 
or sometimes five transactions were tested to support audit conclusions, 
for example: 

• On several audits, DCAA concluded that a contractor had adequate 
controls for removing system access for terminated or transferred 
employees. However, the auditors did not document the employee 
population from which individual employees were selected for testing 
system access, or the methodology used to select them. On none of 
these audits did we see evidence that DCAA auditors checked 
alphabetical listings of individuals having system access to lists of 
current personnel to confirm that access was removed when 
employees transferred or left the company. Without documentation of 
sampling and testing methodologies, there is no way to ascertain how 
the auditors came to their conclusions that controls were adequate or 
that sufficient testing was done to support audit conclusions. 

• For many controls, DCAA did not perform any testing at all. For 
example, at least 6 of the 9 accounting audits we reviewed did not 
include procedures for testing contractor segregation of allowable and 
unallowable cost; 20 of 22 billing system audits we reviewed did not 
include tests to identify duplicate invoices, and 10 of the 22 billing 
system audits of contractors that relied on manual procedures to 
prepare invoices from accounting system data queries did not check 
for compensating controls. For one audit, DCAA issued an adequate 
opinion on the accounting system for a major DOD contractor after 
performing a walkthrough of the accounting process and interviewing 
two employees. 



211 
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Adequate Opinion on Contractor Billing System Was Based on Spot Checks of 4 
Vouchers Generated on the Same Day 

A Mid-Atlantic Region auditor used interviews with contractor staff and limited testing as 
evidence that billing system controls were adequate for a DOD contractor with about 
$40 million in annual government sales. Workpapers documenting audit procedures on 
key internal controls referred to "discussions with the contractor" rather than 
independent auditor verification, including (1) verification of periodic reviews of 
contractor policies and procedures, (2) implementation and effectiveness of policies 
and procedures, (3) frequency and sufficiency of the contractor's management reviews, 
(4) timely processing of offsets, and (5) exclusion of non-billable items from government 
billings. Although the audit was performed from November 2004 through J uly 2005, 
according to the workpapers, the auditor tested a nonstatistical selection of four 
vouchers (invoices) totaling $2.3 million that were all processed on the same day- 
February 28, 2005. The workpapers contained no documentation on the population of 
invoices or the basis for selecting four vouchers for testing that were all processed on 
the same day out of the 8-month period covered by the audit. GAO also determined 
that the auditors performed no testing of the contractor's billing system information 
technology (electronic data processing) controls. As a result, this audit can not be relied 
on for assurance that the contractor's billing system and related internal control policies 
and procedures were adequate as ofj une 16, 2005. 



Audit Supervision GAGAS require that assistants (audit staff) be properly supervised and that 

Problems audit documentation contain evidence of supervisory reviews of the work 

performed that supports findings, conclusions, and recommendations 
contained in the report before the report on the attestation engagement is 
issued. 21 Although workpaper documentation for the majority of the 37 
audits of contractor internal control systems we reviewed evidenced 
supervisory review, we found: 

• A lack of proper documentation of supervisory review in 13 audits. For 
example, for an Eastern Region accounting system audit, the 
supervisory auditor who signed the audit report did not review key 
workpapers related to accounting system transaction processing and 
transaction testing and cost allocations until 1 to 2 days after the audit 
report was issued. This was similar to a situation we found in our prior 
investigation, when supervisors at one DCAA field office frequently 
reviewed the workpapers for forward pricing reports after the reports 
were issued. The auditors also performed insufficient testing on this 
audit. 

• Audit steps were deleted from the standard audit program in an 
accounting system audit and a billing system audit after the supervisors 
approved the audit programs. The supervisors did not ensure that the 
deleted steps were addressed or that documentation was added to the 
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workpapers to explain the reasons why the related audit procedures 
were not performed. 

• For six other audits, audit documentation shows that the supervisors 
and FAO managers extended the audit time frames while contractors 
took actions to correct significant deficiencies. The audit reports were 
issued 1 to 2 years later with adequate ("clean") opinions on controls. 
Although this raises serious auditor independence and reporting issues 
because identified deficiencies were not reported, we are highlighting 
these cases under our discussion of poor supervision to also 
demonstrate the importance of "tone at the top." 



DCAA Extended Audit and "Scrubbed" Audit Documentation after Contractor 
Objected to Findings 

A DCAA Western Region FAO failed to provide proper supervision of auditors throughout 
an accounting system audit of one of DOD's five largest contractors working in Iraq. For 
contractor fiscal year ended December 31, 2004, the contractor reported over $900 
million in sales of which 98 percent related to government contracts, including $250 
million for work in Iraq. The 2004 audit, which was initiated in November 2003, was 
transferred among several auditors and at least three supervisors before its completion 
and August 2006 publication. In September 2005, the contractor objected to draft 
findings and recommendations that included eight significant deficiencies in the design 
and operation of the contractor's accounting system, including inadequate system 
access controls, lack of policies and procedures for segregation of duties, lack of 
periodic reconciliations of cost accounts to the general ledger, and insufficient cost 
ledger information on total base costs by contract and cost elements for applying indirect 
rates. The contractor stated that the auditors did not fully understand the new policies 
and procedures that were just being developed for the fast track effort in Iraq. 

Following the contractor's objections, the auditors revised and deleted some workpapers 
and created new workpapers. GAO's review of the audit documentation identified several 
workpapers that were indexed to supporting documentation that no longer existed. 
Further, the auditors told GAO that because they had difficulty finding support for Iraq 
vouchers, they relied on voucher reviews performed under other DCAA audits. GAO also 
found evidence in the audit documentation that the final supervisor instructed the final 
lead auditor to insert the signature of a prior supervisor on an electronic workpaper after 
it had been revised, thereby making it appear that the prior supervisor had approved the 
workpaper revisions. 

On August 31, 2006, after "scrubbing" the audit documentation atthe supervisor's 
request, dropping five significant deficiencies and downgrading three significant 
deficiencies to suggestions for improvement, DCAA reported an adequate ("clean") 
opinion on the contractor's accounting system. Waiting to review audits with significant 
deficiencies until the end of the job after the work has been completed, raises questions 
about proper and timely supervision. The audit supervisor, who authorized the electronic 
recording of the prior supervisor's name on the audit documentation and supervised the 
issuance of the audit report, was subsequently promoted to be the Western Region 
Quality Assurance Manager, where he went on to act as a quality control check over 
thousands of audits— including several of the audits investigated in GAO 's prior work. 
Following GAO's review, DCAA rescinded the audit report on December 2, 2008. 
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Reporting Problems Audit reports are DCAA's principal work product. According to GAGAS, 

audit reports should, among other criteria, (1) identify the subject matter 
being reported, the criteria used to evaluate the subject matter, the 
conclusion or opinion, and state that the opinion was as of a certain date; 
(2) include a statement of the nature and scope of the work performed and 
state that the audit was performed in accordance with GAGAS; (3) 
disclose any reservations about the engagement, including any scope 
limitations; (4) state the intended use of the report, if limited; and (5) state 
the time frame 22 covered by the audit. Our review of audit documentation 
and DCAA final audit reports determined that none of the 37 DCAA 
reports on contractor systems internal controls met these reporting 
standards, for example: 

• The reports did not cite the specific criteria used in individual audits. 
Criteria represent the laws, regulations, contracts, grant agreements, 
standards, measures, expected performance, defined business 
practices, and benchmarks against which performance is compared 
and evaluated. Criteria identify the required or desired state or 
expectation with respect to the program or operation and provide a 
context for evaluating evidence and understanding the findings. 23 
Instead, the DCAA reports uniformly used boilerplate language to state 
that DCAA audited for compliance with the "FAR, CAS, DFARS, and 
contract terms." As a result the user of the report does not know the 
specific Federal Acquisition Regulation (FAR), Cost Accounting 
Standards (CAS), or contract terms used as criteria to test contractor 
controls. This makes it very difficult for users of the reports to 
determine whether the report provides the level of assurance needed 
to make contract management decisions. In addition, audit 
documentation for many of the audits we reviewed did not identify the 
audit work performed to provide assurance that contractors complied 
with specific requirements in CAS, FAR, DFARS, or contract terms. 

• Six of the 37 audit reports were not issued at the time 24 the work was 
completed. These reports were issued from 8 months to over 2 years 
after the audits were completed. Frequently, we found that the delays 
were the result of serious findings, which led DCAA to withhold 



22 AICPA, Standards for Attestation Engagements, AT §101.63 incorporated by reference 
in GAO-03-673G, § 6.01, and GAO-07-731G, § 6.01. 

23 GAO-07-731G, § 7.37. 

24 GAO-03-673G, §§ 6.50 and 6.24, and GAO-07-731G, § 6.24. 
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issuance of the report while the contractor addressed the problems. 
Because testing was not updated or was not sufficiently updated, the 
reported audit opinions, which related to controls at the time the 
reports were issued, were not adequately supported and may have 
been inaccurate. 

• The audit reports stated the period during which the audit was 
performed but did not disclose the scope and timing for tests of 
vouchers, transactions, or control attributes. Some tests covered a few 
days in only one month or a 3-month period and did not test controls 
across the year audited. As a result, testing did not support the 
reported audit opinions as of the report dates. 

• Contractors imposed restrictions on the scope of four audits by 
denying DCAA access to certain records. The access-to-records issues 
were not fully resolved or disclosed by the auditors. 

• The scope of 33 audits was limited by DCAA imposed, or implied, 
restrictions, including inadequate audit resources, unclear audit 
guidance on nature and extent of testing, and time constraints that 
prevented auditors from performing sufficient work to support 
reported opinions on contractor internal controls. DCAA officials told 
us that DCAA does not have sufficient resources to perform full-scope 
audits of contractor internal controls. 

Failure to issue reports when sufficient evidence has been obtained to 
support an auditor's conclusion puts decision makers at risk of relying on 
out-dated or inaccurate information. Also, when DCAA auditors do not 
perform the scope of work necessary to support the reported audit 
opinions, the audit reports provide a false level of assurance. Following 
our discussion of these audits with DCAA headquarters officials, DCAA 
rescinded 4 of the 6 audit reports that did not accurately relate the period 
of testing to the audit opinion, and it rescinded 18 audit reports where the 
scope of work did not support the audit opinions. The discussion below 
describes a particularly egregious example of this problem. 
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Two Years after Testing Controls, DCAA Reported the Results of an Audit of a 
Multibillion Dollar Contractor's Billing System 

In J uly 2003, DCAA initiated a billing system audit of a contractor doing business in Iraq 
with sales of $6.3 billion at the two divisions under audit. More than 2 years after 
performing test procedures and after spending 1,025 hours on the audit, the FAO 
issued an opinion that the contractor's billing system controls were adequate as of 
August 31, 2005, without updating the testing. 

In 2003, DCAA auditors tested 38 vouchers submitted for payment within a 12-day 
period. DCAA auditors identified numerous billing errors, including two instances where 
billings did not comply with the Federal Acquisition Regulation (FAR). On August 12, 
2004, DCAA auditors prepared a draft report with an adequate opinion and three 
suggestions for improvement. DCAA auditors did not perform testing in 2004 or in 2005 
despite the number of errors found as a result of limited test procedures performed in 
2003. As a result, the evidence does not support the opinion that the contractor's billing 
system controls are adequate as of August31, 2005. Additionally, there is no evidence 
in the workpapers that the contractor resolved the errors DCAA identified and the 
underlying system deficiencies that caused those errors. This is of special concern 
because billing errors and system deficiencies at this contractor put multiple agencies 
at risk. For example, this contractor does work not only for DOD but also for the 
Departments of Agriculture, Commerce, Interior, and NASA, and several other 
agencies. 

The lead auditor told us that this audit was delayed because numerous auditors were 
assigned over the course of this audit, and the contractor's work in Iraq took 
precedence over this audit. However, we found no evidence supporting a decision not 
to issue this report when the testing was completed in 2003. Following GAO's review, 
DCAA rescinded the audit report on April 7, 2009. 
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DCAA performs assignments that are designed to test various contractor 
costs as allowable, reasonable under the related contracts, the Federal 
Acquisition Regulation (FAR), and Cost Accounting Standards (CAS). 
Although DCAA uses the term "audit" generically, some of these 
assignments are audits and other assignments relate to financial and 
advisory services. We reviewed 32 cost-related assignments 1 performed by 
seven geographically disperse field audit offices (FAO) across the five 
DCAA regions (the same offices as in appendix I) to assess whether (1) the 
tests of contractor costs, billings, and payments were effective in 
identifying overpayments, billing errors, and unallowable cost 2 and 
(2) DCAA identified and reported unallowable and unsupported costs, 
overpayments, and billing errors so that the government was in a position 
to collect or recover improper costs and billings through refunds, contract 
adjustments, or offsets. The 32 DCAA cost-related assignments we 
reviewed included 16 paid voucher reviews, 10 overpayment assignments, 
4 incurred cost audits, and 2 request for equitable adjustment (REA) 
audits. 3 Although DCAA performs incurred cost and REA audits as 
engagements in accordance with generally accepted auditing standards 
(GAGAS), DCAA does not consider paid voucher reviews or overpayment 
audits to be GAGAS assignments. DCAA performed the paid voucher 
reviews to assess the accuracy of contractor billings to support decisions 
to approve contractors for participation in the direct-bill program, 4 
whereby the contractor submits invoices directly to a federal agency 
paying office without government review of the invoices prior to payment. 
Overpayment assignments review contractor controls for identifying and 



1 We initially selected 34 cost-related audit assignments for review. After reviewing the 
audit documentation, we determined that one assignment only covered part of an audit and 
the other assignment was terminated and the procedures were incorporated into a related 
billing system audit. Therefore, we reviewed a total of 32 completed cost-related 
assignments. 

2 Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate payments and payments in excess of amounts billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billings for unallowable cost. Recoveries of 
overpayments can be accomplished through refunds, subsequent billing offsets, or other 
adjustments to correct billing errors. Unallowable costs include lobbying cost, certain legal 
expenses, executive and management bonuses, luxury items, and certain overhead costs. 

3 REA relates to contractor requests to adjust contract terms for rates and payments 
resulting from contract modifications. In the case of the two REA audits, contract 
modifications related to requests for increased hours of service and related labor and 
materials. 

4 FAR § 42.101 and DFARS § 242.803. 
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refunding, offsetting, or adjusting contract overpayments and billing 
errors. 

Similarly, DCAA performs overpayment assignments at the request of 
contracting officers to determine (1) whether contractor controls are 
effective in identifying overpayments made by disbursing officers or over 
billings and billing errors made by contractors and (2) if contactors are 
making timely refunds, offsets, or adjustments. 

At the time the 32 cost-related assignments were performed, FAR § 52.232- 
25(d) imposed a requirement on contractors to immediately notify the 
contracting officer and request instructions for disposition of any 
overpayment when the contractor becomes aware of a duplicate or 
overpaid contract financing or invoice payment. 5 Also, FAR 32.604(b)(4) 
provides that contractors shall repay debts under a demand letter within 
30 days, except for certain debts covered by specific terms of the 
contract. 6 This time period is incorporated into most contracts under FAR 
Clause 52.232-17(a). We found that DCAA auditors are not consistent 
when assessing the timeliness of refunds and offsets. Specifically, 
although DCAA's overpayment work program cites 30 to 60 days after the 
overpayment occurred as timely, 7 some DCAA auditors considered 90 days 
as timely which effectively minimized the impact on the contractors' cash 
flow. 

We also found limited testing in the four incurred cost audits we reviewed. 
DCAA considers incurred cost audits to be GAGAS attestation 
engagements. Incurred cost audits examine contractors' annual claims for 
payment of cost incurred. DOD contracting officers rely on DCAA incurred 
cost audits to approve contractor claims for payment. 8 DCAA incurred 
cost audits and proposal audits are the source of most DCAA questioned 
costs and dollar recoveries. Dollar recoveries are based on contracting 



5 FAR 52.232-25(d) was amended in October 2008 to require contractors to monitor for and 
make adjustments to correct overpayments they may receive, but it still does not specify a 
timeframe for making any needed adjustments. 

6 FAR 32.606(a). 

7 DCAA, Audit of Contract Overpayments Audit Program, version 2.1, October 2006. 

8 Although the government pays contractor invoices on a provisional basis when they are 
submitted for payment, DCAA incurred cost audits provide the basis for final approval of 
contractor incurred costs claims. 
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officer agreement with DCAA questioned costs. 9 DOD contracting officers 
are responsible for enforcing DCAA recommendations to disallow 
questioned cost. Figure 3 provides a comparison of costs questioned by 
DCAA auditors and questioned costs sustained (recovered) by DOD 
contracting officers. 



Figure 3: DCAA Questioned Costs and Amounts Sustained by Contracting Officers 

Dollars (in billions) 
8 




2 





2000 2001 2002 2003 2004 2005 2006 2007 2008 

Fiscal year 

- - - Questioned costs 
^— ^— Questioned costs sustained 
Source: GAO analysis of DCAA data. 



For one of the four incurred cost audits we reviewed, DCAA rescinded the 
related accounting system audit report in response to concerns we 
identified with that report. For a second incurred cost audit we reviewed, 
DCAA rescinded the related billing system report. Risk assessments for 
determining the nature, extent, and timing of testing for incurred cost 
audits are based in part on the results of accounting and billing system 
audits. Therefore, a rescission of an accounting or billing system audit 



9 Questioned costs include costs questioned by DCAA auditors as unallowable or 
unsupported. 
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would call into question the risk assessment performed for the related 
incurred cost audits. 

The case study examples in table 6 illustrate significant problems we 
identified with the DCAA cost-related assignments we reviewed. As 
previously discussed, the level of testing in these assignments was not 
sufficient to identify all potential contractor billing errors and 
overpayments. 



Table 6: Case Studies of Problem DCAA Cost-Related Assignments 


Region 


Type of assignment 


Details of review 


Central 


Paid voucher review (2006) 
Non-GAGAS 


For this review of paid contractor invoices, the auditor relied on the results of DCAA's 
2005 billing system audit and did not test any invoices. The workpapers stated that the 
auditor also relied on the results of the 2005 paid voucher assignment. However, that 
assignment did not test any 2006 invoices. 

Further, as a result of GAO's work, DCAA had rescinded the 2005 billing system audit 
report on February 10, 2009. 

As a result, there is no audit support for DCAA's approval for this contractor to directly 
bill the government. 


Central 


Paid voucher 
review (2005) 
Non-GAGAS 


In planning this work, the auditor improperly assessed risk as low and deleted several 
steps from the standard "audit" program. 

The auditor did not identify the population of vouchers (invoices) and selected two 
invoices for testing, but only tested one of them. 

The auditor tested one invoice to see if the payment received by the contractor 
matched the amount billed. 

On J anuary 23, 2006, DCAA issued a Memorandum for the Record, stating "reliance 
can be placed on the contractor's procedures for preparation of interim vouchers. 
Accordingly, the contractor has met the criteria for continued participation in the direct 
billing program." 


Western 


Paid voucher 
review (2005) 
Non-GAGAS 


Without documenting the population of vouchers or the total dollars billed during the 
contractor's fiscal year, the auditor tested 8 of 734 vouchers issued from April 16, 2004, 
through March 25, 2005. 

The supervisor incorrectly directed the auditor to test a final voucher. Paid voucher 
assignments focus on interim vouchers as a basis for making direct-bill decisions. Final 
vouchers are submitted to close out a contract. 

The auditor did not identify any errors in the vouchers tested. 

On September 30, 2005, the auditor prepared a Memorandum for the Record, stating 



that "continued reliance can be placed on the contractor's procedures for preparation of 
interim vouchers. Accordingly, the contractor has met the criteria for continued 
participation in the direct billing program." 
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Region Type of assignment Details of review 

Eastern Paid voucher review (2004) • Although the contractor generated $1.1 billion in annual billings to the government, the 
Non-G AGAS auditor assessed risk as low for this assignment. Without documenting the basis for the 

'" f "'°"' :J risk assessment, the auditor judgmentally selected 3 vouchers totaling $88,000 for 

testing out of a total of 222 vouchers submitted to the government for payment from 
March 2003 through February 2004. 

The auditor tested the first voucher selected and performed limited testing on the 
remaining 2 vouchers. 

The workpapers do not include any evidence to show that the auditor performed most 
of the audit steps required in the standard audit program. 

Despite limited testing, on March 31, 2004, DCAA prepared a memorandum for the 
record, stating "continued reliance can be placed on the contractor's procedures for the 
preparation of interim vouchers" and "the contractor has met the criteria for continued 
participation in the direct billing program." 



Source: GAO analysis of DCAA audit documentation. 
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Pursuant to a request from the Chairman and Ranking Member of the 
Senate Committee on Homeland Security and Governmental Affairs, we 
conducted an agencywide performance audit to assess the effectiveness of 
Defense Contract Audit Agency (DCAA) audits for helping to assure that 
prices paid by the government for needed goods and services are fair and 
reasonable and that contractors are charging the government in 
accordance with applicable laws, regulations, cost accounting standards, 
and contract terms. The overall objectives of our work were to (1) conduct 
a broad assessment of DCAA's management environment and quality 
assurance structure, (2) evaluate DCAA corrective actions in response to 
our prior investigation 1 and DOD Comptroller/CFO "tiger team" and 
Defense Business Board (DBB) studies, and (3) identify potential 
legislation and other actions that could improve DCAA's effectiveness and 
independence. 

To address our first objective, we evaluated DCAA's contract audit 
guidance and policies and its quality assurance program and assessed the 
quality of a nationwide selection of DCAA audits. We evaluated the results 
of internal DCAA audit quality assurance reviews on audits issued from 
fiscal year 2003 through 2008. We also reviewed a total of 69 DCAA audits 
and cost-related assignments. 2 In reviewing DCAA audits, we used 
generally accepted government auditing standards as our criteria. 3 The 69 
DCAA audits and cost-related assignments we reviewed included 37 audits 
of contractor internal controls and 32 cost-related audits and assignments. 
We did not assess a statistical sample of DCAA audits. Rather, we focused 
on DCAA offices that reported predominately adequate, or "clean," 
opinions on audits of contractor internal controls over cost accounting, 
billing, and cost estimating systems issued in fiscal years 2005 and 2006. 4 
We selected DCAA offices that reported predominately adequate ("clean") 



1 GAO-08-857. 

2 As stated in DCAA's Contract Audit Manual, CAM 2-100, DCAA uses the term audit to 
refer to a variety of audits, evaluations, reviews, assessments, and analyses. 

3 GAO, Government Auditing Standards: 2003 Revision, GAO-03-673G (Washington, D.C: 
June 2003) and Government Auditing Standards: 2007 Revision, GAO-07-731G 
(Washington, D.C: July 2007). 

4 In selecting the seven DCAA offices, we considered a 2-year history of internal control 
audit results. The seven DCAA offices we selected reported adequate opinions on 89 
percent or more of the internal control reports they issued during fiscal year 2006. During 
fiscal year 2005, four of the seven offices reported adequate opinions in 85 percent or more 
of the internal control reports they issued, and the other 3 offices issued adequate opinions 
in 50 to 69 percent of the internal control audit reports they issued. 
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opinions on contractor systems and related internal controls because 
contracting officers rely on these opinions for three or more years to make 
decisions on pricing and contract awards, and payment. For example, 
audits of estimating system controls support negotiation of fair and 
reasonable prices. 5 Also, the Federal Acquisition Regulation (FAR) 
requires contractors to have an adequate accounting system prior to award 
of a cost-reimbursable or other flexibly-priced contract. 6 Billing system 
internal control audit results support decisions to authorize contractors to 
submit invoices directly to DOD and other federal agency disbursing 
offices for payment without government review. 7 In addition, DCAA uses 
the results of internal control audits to assess risk and plan the nature, 
extent, and timing of tests for other contractor audits. When a contractor 
has received an adequate opinion on its systems and related controls, 
DCAA would assess the risk for subsequent internal control and cost- 
related audits as low and would perform less testing on these audits. 

Using this approach, we identified seven geographically disperse DCAA 
field offices within the 5 DCAA regions and targeted 39 audits of 
contractor cost accounting, billing, and estimating system controls issued 
during fiscal years 2004 through 2006 for review. 8 These were the most 
recent completed fiscal years at the time we initiated our audit. Two of the 
39 internal control audits we identified were performed as assist audits to 
a billing system audit and we considered them as part of the billing system 
audit we reviewed. Therefore, we reviewed a total of 37 audits of 
contractor internal controls for compliance with GAGAS and DCAA 
policy. We also considered whether DCAA adequately applied internal 
control standards in its audits that are applicable to the private sector. 9 We 



5 DCAA Contract Audit Manual (CAM) 5-1202. la and Defense Federal Acquisition 
Regulation Supplement (DFARS) § 215.407-5. 

6 FAR § 16.301-3(a)(l). 

7 FAR § 42.101, and DFARS § 242.803. 

8 In the case of follow-up audits, we also reviewed the documentation for the previous audit 
to gain an understanding of the scope of work and deficiencies previously identified. 

9 The Internal Control Integrated Framework developed by the Committee on Sponsoring 
Organizations (COSO) of the Treadway Commission, September 1993, are applicable to 
private sector entities. We considered whether DCAA audits addressed contractor controls 
related to the five key control activities: (1) contractor control environment; (2) contractor 
risk assessment; (3) control activities, including policies and procedures and segregation of 
duties; (4) information and communication (i.e., information system processing controls); 
and (5) monitoring. 
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did not review classified audits performed by DCAA's field detachment 
office. Although our selection of the seven offices and 37 internal control 
audits was not statistical, it represented about 9 percent of the total 76 
DCAA offices that issued audit reports on contractor internal controls and 
nearly 18 percent of the 40 offices that issued 8 or more reports on 
contractor internal controls during fiscal year 2006. Of the 37 internal 
control audits we reviewed, 32 reports were issued with adequate opinions 
and 5 reports were issued with inadequate-in-part opinions. Table 7 
summarizes the number and types of contractor internal control audits we 
reviewed for seven FAOs across the 5 DCAA regions. 



Table 7: Summary of DCAA Audits Reviewed for GAGAS Compliance 




Type of internal control audit 








Region/FAO 


Indirect & other 
Accounting system direct cost 


Billing system 


Estimating 
system 


Total internal 
control audits 


Northeast 


FAO #1 






3 


1 


4 


Mid-Atlantic 


FAO #2 


2 - 




3 




5 


Eastern 


FAO #3 


1 1 




3 


1 


6 


Central 


FAO M 


2 - 




2 


1 


5 


FAO #5 


2 - 




5 




7 


Western 


FAO #6 


- 1 




3 


1 


5 


FAO #7 


2 




1 


2 


5 


Total 


9 2 




20 


6 


37 



Source: GAO analysis of DCAA management information system data. 



At the same seven DCAA field offices, we selected 34 cost-related 
assignments performed during the same period as the internal control 
audits we reviewed and analyzed supporting documentation to determine 
whether the assignments included sufficient testing to assess whether 
(1) the tests of contractor costs, billings, payments were effective in 
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identifying overpayments, billing errors, and unallowable cost 10 and 
(2) DCAA reported overpayments, billing errors, and unallowable and 
unsupported costs, so that the government was in a position to recover 
improper payments through refunds, contract adjustments, or offsets and 
avoid payment of unsupported and unallowable costs. Upon reviewing 
documentation for the 34 cost-related audits, we determined that one of 
these assignments covered the risk assessment portion of an incurred cost 
audit and was not a complete audit. Documentation for a second 
assignment to test for overpayments was terminated and the audit 
procedures were rolled into a billing system audit. Consequently, as shown 
in table 8, we reviewed a total of 32 cost-related DCAA assignments. These 
assignments included paid voucher reviews and overpayment control 
assignments and audits of requests for equitable adjustment (REA) 11 and 
contractor incurred cost claims. 



Table 8: Summary of DCAA Cost-Related Assignments Reviewed 







Type of Assignment 








Region/FAO 


Paid Voucher review 


Over payment 
assignment REA audit 


Incurred Cost audit 


Total assignments 


Northeast 


FAO #1 




1 


2 


2 


5 


Mid-Atlantic 


FAO #2 


4 


1 




1 


6 


Eastern 


FAO #3 


3 


3 






6 


Central 


FAO M 


1 


1 






2 


FAO #5 


5 


2 






7 



Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate payments and payments in excess of amounts billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billing for unallowable cost. Recoveries of 
overpayments can be accomplished through refunds, subsequent billing offsets, or other 
adjustments to correct billing errors. Unallowable cost include lobbying cost, certain legal 
expenses, executive and management bonuses, luxury items, and certain overhead costs. 

11 REA audits relate to reviewing contractor requests for adjustments in billing rates 
pursuant to contract modifications. For example, if a contractor is asked to provide 
additional services or expand hours of service, contract costs would need to be 
recalculated and adjusted rates verified. REA audits relate to audits of contractor 
estimating system controls. 
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Type of Assignment 






Region/FAO 


Paid Voucher review 


Over payment 
assignment REA audit 


Incurred Cost audit 


Total assignments 


Western 


FAO #6 


3 


1 - 




4 


FAO #7 




1 


1 


2 


Total 


16 


10 2 


4 


32 



Source: GAO analysis of DCAA management information system data. 



The details of our assessments of DCAA audits of contractor internal 
control systems and cost-related audits and assignments are included in 
appendixes I and II, respectively. Examples of our findings are included in 
the body of this report to help illustrate the effect of our findings related to 
DCAA's management environment. 

To assess DCAA's management environment and quality control system, 
we reviewed DCAA's mission statement, strategic plan, performance 
metrics, quality assurance program, audit planning and policy guidance, 
and human capital management. We evaluated the results of internal 
DCAA audit quality assurance reviews on audits issued from fiscal year 
2004 through 2008. We used requirements in the Government Performance 
and Results Act, 12 GAGAS, 13 and GAO's Standards for Internal Control in 
the Federal Government 14 as our criteria. 

We analyzed the findings, conclusions, and recommendations in the DOD 
Inspector General's (IG) 2007 report on its oversight review of DCAA, 15 
which serves the purpose of a peer review. We did not review DOD IG 
documentation for the oversight review. In assessing the DOD IG peer 
review conclusions and opinion, we considered the inconsistencies 
between the findings and recommendations in the IG report. In addition, 
we considered the results of our analysis of DCAA audits in our prior 
investigation; our review of the 69 DCAA audits and related assignments 



" Pub. L. No. 103-62, 107 Stat. 285 (Aug. 3, 1993). 

13 GAO-03-673G, and GAO-07-731G. 

14 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-2 1.32.1 
(Washington, D.C.: November 1999). 

15 DOD Inspector General, Oversight Review: Review of the Defense Contract Audit 
Agency Quality Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 
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covered in this report; the results of DCAA's internal quality assurance 
reviews; and DCAA's actions to rescind 80 audit reports. 

To achieve our second objective, we reviewed the status of several key 
actions that DCAA initiated as a result of our earlier investigation, 
including efforts to 

• revise DCAA's mission statement and strategic plan to focus on 
protecting the public interest; 

• change performance metrics to focus on audit quality instead of 
performing large quantities audits; 

• end DCAA involvement with integrated product teams, which we 
identified as an impairment to DCAA's independence; 

• improve audit quality by revising audit policy guidance and realigning 
DCAA's audit quality assurance structure; and 

• update training courses to reflect changes in DCAA's mission, metrics, 
and audit policy. 

Although the October 2008 Defense Business Board report recommended 
that the Secretary of Defense revise DCAA's mission statement to focus on 
protecting the public interest, at the time we completed our work in July 
2009, DCAA's mission statement had not yet been revised. To assess 
changes in performance metrics, we analyzed DCAA's new metrics and 
determined whether changes made in September 2008 were effective in 
shifting DCAA focus from report production to performing quality audits 
and if the new metrics had been integrated into DCAA's performance 
plans, auditor expectations, and performance appraisal standards. In 
addition, we made selected calls to one or more auditors in 15 selected 
DCAA offices that were separate from the offices we visited to review 
audit documentation and interviewed auditors about their experience with 
changes in DCAA policies and performance metrics. We also considered 
34 additional hotline allegations we received from auditors across the 5 
DCAA regions after our investigative report was issued. We used GAGAS 
criteria 16 to assess the effectiveness of DCAA policy changes and DCAA's 
centralization of the audit quality function aimed at improving auditor 
independence and audit quality. We used GAO's Internal Control 



GAO-03-673G, and GAO-07-731G. 
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Standards as our criteria for assessing DCAA's management environment, 
culture, need for a risk-based audit approach, and human capital practices. 

To achieve our third objective to identify potential legislative and other 
actions to improve DCAA's effectiveness, we considered DCAA's current 
role and responsibilities; the framework of statutory authority for auditor 
independence in the Inspector General Act of 1978, as amended; 17 best 
practices of leading organizations that have made cultural and 
organizational transformations; our past work on DCAA organizational 
alternatives; 18 GAGAS criteria for auditor integrity, objectivity, and 
independence; and GAO's Standards for Internal Control 19 on managerial 
leadership and oversight. We identified potential short-term and longer 
term legislative actions and organizational changes that could enhance 
DCAA's effectiveness and independence. 

Throughout our audit we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and DCAA 
Region and FAO managers, supervisors, and auditors. We also met with 
DOD Office of Inspector General (OIG) auditors responsible for DCAA 
audit oversight and DOD IG hotline office staff. We assessed the reliability 
DCAA data used in our work by reviewing DCAA procedures for assuring 
the reliability of reported performance data, discussing the compilation 
and use of these data with DCAA operations personnel, and performing 
analytical procedures to determine the reliability of specific data used in 
our analysis. For example, we determined that DCAA assignments 
initiated in one year and completed in the second year were double 
counted. We eliminated duplicate records from data used for our analysis. 
We also met with the former DOD Comptroller/CFO to discuss plans for 
the Office of Comptroller/CFO and Defense Business Board reviews, and 
we continued to meet with and obtain information from the new DOD 
Comptroller/CFO and his staff. We also met with the Comptroller's new 
DCAA Oversight Committee, which includes the Auditors General of the 
Army, the Navy, and the Air Force; the DOD Director of Defense 
Procurement and Acquisition Policy; and the DOD Deputy General 
Counsel for Acquisition. 



11 5 U.S.C., App. 

18 GAO, Defense Contract Audits: Current Organizational Relationships and 
Responsibilities, GAO/AFMD-91-14 (Washington, D.C.: Apr. 3, 1991). 

19 GAO/AIMD-00-21.3.1. 
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We conducted this performance audit from August 2006 through 
December 2007, at which time we suspended this work to complete our 
investigation of hotline complaints regarding audits performed at three 
DCAA field offices. We resumed our work on this audit in October 2008 
and performed additional work through July 2009 to evaluate DCAA's 
quality assurance program during fiscal years 2007 and 2008, assess DCAA 
corrective actions, and consider organizational placement options. We 
conducted our audit in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
believe that the evidence obtained provides a reasonable basis for findings 
and conclusions based on our audit objectives. We performed our 
investigative procedures in accordance with quality standards set forth by 
the Council of the Inspectors General on Integrity and Efficiency (formerly 
the President's Council on Integrity and Efficiency). 
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Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 




UNDER SECRETARY OF DEFENSE 
I tOO DEFENSE PENTAGON 
WASHINGTON, DC 20301-1 1O0 



SEP ~4 2009 



COMPTROLLER 



Mr. Gregory Kutz 

Managing Director, Forensic Audits and Special Investigations 
Government Accountability Office (GAO) 
441 G. St., NW 
Washington, DC 20548 



Dear Mr. Kutz: 



This is the Department of Defense (DoD) response to the GAO draft report GAO- 
09-468, "DCAA AUDITS: Widespread Problems with Audit Quality Require 
Significant Reform," dated July 3 1 , 2009 (GAO code 1 95099). We thank you for the 
opportunity to respond to the GAO draft report and recommendations. Those 
recommendations directed to the DoD Inspector General will be provided directly by that 
office under separate cover. 

The Department concurs with all but one of the GAO recommendations 
(Enclosure 1). We disagree with some of GAO comments for Congressional 
consideration (Enclosure 2). Enclosure 3 contains a listing of corrective actions DCAA 
has implemented since 2008. As part of our review of the GAO draft report, we noted 
several areas where we believe further clarification and explanation are needed so the 
circumstances can be completely understood. The clarifying comments are provided in 
Enclosure 4. Comments from the Director, Defense Procurement and Acquisition Policy 
are provided as Enclosure 5. 

The Department and the Defense Contract Audit Agency (DCAA) are committed 
to taking the necessary corrective actions to address the GAO findings. This office will 
continue to monitor DCAA to ensure timely completion of critical actions to address the 
GAO's recommendations. To assist with this monitoring, in March 2009, 1 established a 
DCAA Oversight Committee to provide my office advice and recommendations related 
to the oversight of DCAA. This committee includes Auditors General of the Army, the 
Navy, and the Air Force; the Director of Defense Procurement and Acquisition Policy; 
and the DoD Deputy General Counsel for Acquisition and Technology. The committee 
will assess DCAA's activities, its corrective actions taken to this and other oversight 
reports, and identify any gaps. I have also assigned a member of my senior staff to assist 
in the oversight efforts. 

We acknowledge that the draft GAO report raises serious issues that we need to 
continue to address. We will continue to improve audit quality, especially for internal 
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control audits. We will reassess the number of audits that DCAA performs and ensure 
that adequate staffing is available to conduct those audits in accordance with generally 
accepted government auditing standards (GAGAS). We will ensure that DCAA has 
adequate independence. We will also ensure that an appeals mechanism is created to 
provide a process for resolving disputes between DCAA and the contracting 
organizations. 

While we acknowledge that continued work on these serious issues is required, we 
disagree with the suggestion in the GAO report that we have not yet begun to address the 
weaknesses. The GAO report states that "DoD and DCAA have not yet addressed the 
fundamental weaknesses in DCAA's mission, strategic plan, metrics, audit approach, and 
human capital practices that have had a detrimental effect on audit quality." We believe 
that we have begun to address these issues. The audit assignments covered by this review 
were completed 3-5 years ago, several years before DCAA implemented a series of 
corrective actions beginning in late 2008. Although a significant number of short-term 
actions have been completed, DCAA has many long-term actions still in-process. It may 
take several years to experience the full effect on the execution of the DCAA audits. 
Enclosure 3 contains the list of corrective actions DCAA has implemented in late 2008 
and to-date in 2009. 

While we acknowledge GAO's findings are serious, DCAA has and continues to 
play a vital role in support of the contracting process in ensuring that DoD pays a fair and 
reasonable price in accordance with applicable regulations in protecting the taxpayers' 
dollars. In FY 2008 alone, DCAA audits recommended reductions in proposed or billed 
costs of $17.9 billion (referred to as questioned costs) and $7.2 billion in estimated costs 
where the contractor did not provide sufficient information to explain the basis of the 
estimated amounts (referred to as unsupported costs). Additionally, the current Director 
of Defense Procurement and Acquisition Policy, a key DCAA stakeholder, has stated that 
he finds DCAA's work critical to the acquisition process (Enclosure 5). 

DCAA's important work was showcased in three hearings of the Commission on 
Wartime Contracting in 2009. One hearing focused on contractor business systems, a 
type of audit that is the subject of the GAO report. Through June 2009, DCAA has cited 
deficiencies in contractor systems in over half of the 200 audits performed on the 
contractors performing effort in-theater. The Commission remarked that hundreds of 
millions of dollars have been recovered as a result of DCAA's audits and that DCAA's 
efforts were extraordinary considering the performance of audits in a war zone. Several 
of the Commissioners remarked during a recent hearing that DCAA was the finest audit 
organization they had worked with and the most forthright and responsive of all the 
organizations that have interacted with the Commission to date. 
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Several of the key actions DCAA has taken to address DCAA's management 
environment involved the use of external organizations to guide DCAA through its 
"cultural transformation." For example, DCAA has engaged the Naval Post Graduate 
School's Center for Defense Management Reform to assist with the development and 
execution of various long-term organizational improvement projects. These projects 
address the following questions: 

1 . How can DCAA put people first to guide its decisions, actions and 
values? For example, how can DCAA place an increased emphasis on 
"soft skills" such as building morale and developing employees (in 
terms of a broad understanding as well as technical proficiency)? 

2. How can DCAA develop leaders to serve the employees and the 
organization? 

3. How can DCAA structure the organization to facilitate compliance with 
GAGAS, maximize audit results/return on investment (ROI), and better 
align Agency workload/resources? 

4. How can DCAA identify and resolve differing stakeholder expectations 
with contracting officers, contractors, the public (Congress), and 
external review organizations? 

DCAA has also engaged the Army Force Management Support Agency (AFMSA) 
to assess DCAA's risk-based audit requirements planning process for FY 2010. AFMSA 
will also assist in translating the requirements planning into staffing needs. 

One of the major findings reported by the GAO is the lack of sufficient transaction 
testing to support the conclusions when giving an opinion on contractor internal control 
systems. We concur that many of the assignment working papers did not reflect the level 
of testing required by the GAO to opine on the system of internal controls. DCAA has 
rescinded audit reports and initiated full scope internal control audits at these locations. 
In light of the GAO's findings, DCAA will be assessing the need to opine on contractor 
internal controls or whether an opinion on the sufficiency of the contractors' business 
systems for Government contracting purposes is appropriate. We suggest that the GAO 
and the DoD Inspector General (IG) work closely with DCAA in its assessment and 
redesign of testing procedures for opining on contractor business systems. 

It is worth noting that the additional transaction testing will require an increase in 
audit staff at DCAA. Some of the increase is already underway through the use of the 
Defense Acquisition Workforce Development Fund. Using this fund, DCAA has 
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increased staffing by 300 in FY 2009 and plans to increase by an additional 200 each in 
FYs 20 1 and 20 1 1 , with a total increase of 700 by the end of FY 20 1 1 . However, this 
may not be enough to accomplish the audits required by regulation in light of the 
additional testing stipulated by the GAO. We will continue to monitor the staffing 
situation at DCAA. But to accomplish the significant increase in testing during internal 
control audits, DCAA will be required to defer lower risk assignments to FYs 2010 and 
201 1, which could have a negative impact on the timely closing of contracts prior to the 
cancelation of funds. The overall issue of risk assessment, as outlined in the GAO draft 
report, is one of the main discussion topics I have assigned to the DCAA Oversight 
Committee. 

The Department concurs with the GAO that the root causes for many of the 
GAGAS noncompliances related to the prior DCAA performance measures. As the GAO 
acknowledges, in September 2008, DCAA took aggressive action by revising the 
performance measures to promote quality audits. During FY 2009, DCAA has 
continually assessed the performance measures by conducting focus groups in several 
regions (including the DCAA Western Region). In general, the focus groups confirmed 
that there was much less emphasis on performance measures than in the past. 

The GAO draft report states that DCAA has taken some actions to improve its 
quality assurance program; however, it stated that staffing difficulties and other issues 
have left the outcome of this important initiative uncertain. We disagree. DCAA has 
been proactive in standing up its new Integrity and Quality Assurance Directorate - 
essentially a new quality assurance organization that reports directly to the 
Director/Deputy Director. DCAA has revised its quality assurance program for reporting 
GAGAS noncompliances and requires audit offices to provide corrective action plans that 
address all GAGAS noncompliances reported. The Headquarters Quality Assurance 
organization will follow-up on each systemic noncompliance to ensure the field audit 
offices have corrected their processes. In July 2009, DCAA was authorized a Senior 
Executive Service position to lead the Quality Assurance Directorate. We believe the 
extensive overhaul of the quality assurance function accomplished in FY 2009 will 
mitigate the prior shortcomings in audit quality cited by the GAO. 

In January 2009, the DCAA Director established a Senior Advisory Council for 
Improvement which is led by the Director and comprised of Headquarters senior 
executives. The Council's primary purpose is to establish and monitor the actions in 
response to the report issued in January 2009 by the Independent Review Panel to the 
Defense Business Board and findings from the GAO and DoD IG reviews. The 
establishment of this council exemplifies the Director's efforts in ensuring key Agency- 
wide actions are managed at the Headquarters level versus the regional level. We believe 
the establishment of this DCAA Headquarters council, in addition to re-aligning the 
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Quality Assurance Program to report directly to the Director/Deputy Director, results in 
significant progress toward addressing the GAO's concerns with DCAA's "decentralized 
structure that has fostered a culture of DCAA region autonomy." 

The GAO draft report states that the supervisors responsible for deficient audits 
identified in GAO's prior investigation were promoted even though the GAO 
investigation disclosed significant GAGAS noncompliances with the audits they 
supervised. The GAO states that "despite these findings, we found no evidence that 
supervisors and auditors who did not follow GAGAS and DCAA policy were disciplined, 
counseled or required to take additional training." DCAA has required several of the 
supervisors to take additional supervisory and management training courses. They have 
completed some of these courses and are scheduled to take additional training in the next 
fiscal year. Based on advice provided by the DoD Washington Headquarters Services 
Office of General Counsel, DCAA did not take performance or conduct actions against 
these supervisors. Additionally, all DCAA employees, including the employees involved 
in the GAO's 2008 hotline investigation, have completed annual training on auditor 
"independence" and training in audit quality, including GAGAS, at mandatory stand- 
down days in August 2008 and 2009. 

We appreciate the recommendations made by the GAO. We believe the 
implementation of these recommendations along with the many actions that the 
Department and DCAA have already completed will improve DCAA culture and 
management environment to ensure taxpayer dollars are protected and DoD audit needs 
are met. DoD and DCAA leaders are committed to maintaining a strong contract audit 
function. 

My point of contact on this matter is Mr. M. Wayne Goff. He can be reached by 
e-mail at wayne.goff@osd.mil or by telephone at 703-602-0374. 

Sincerely, 
Robert F. Hale 

Enclosures: 
As stated 
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GAO DRAFT REPORT DATED JULY 3 1 , 2009 
GAO-09-468 (GAO CODE 195099) 



'DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM" 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO RECOMMENDATIONS 



RECOMMENDATION 1 : The GAO recommends that the Secretary of Defense revise 
the Defense Contract Audit Agency's (DCAA) mission statement to reflect the need for 
quality contract audits and related nonaudit services that take into account serving the 
public interest. 

POD RESPONSE : Concur. The Department is currently seeking final coordination on a 
revised DCAA mission statement which is included in an updated DoD Directive 
5105.36, DCAA. 

RECOMMENDATION 2 : The GAO recommends that the Secretary of Defense require 
the Under Secretary of Defense (Comptroller/CFO) to establish milestones for 
completing DCAA corrective actions and monitor and regularly report on DCAA 
progress to assure timely completion of critical actions. 

DOD RESPONSE : Concur. The Department will continue to establish milestones for 
completing DCAA corrective actions. DCAA already provides USD(C) a monthly status 
report of the actions taken in response to the recommendations made by the Independent 
Review Panel of the Defense Business Board as well as recommendations from various 
GAO and DoD IG reviews. DCAA will expand its improvement plan to incorporate the 
GAO's recommendations. USD(C) has assigned a senior staff member to assist in 
oversight and has created the DCAA Oversight Committee, including all three auditors 
general from the Services, the OSD Deputy General Counsel for Acquisition and 
Logistics, and the Director of Defense Procurement and Acquisition Policy, to assist in 
oversight efforts. 

RECOMMENDATION 3 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the Defense 
Contract Audit Agency (DCAA) in concert with the revised mission statement, develop a 
Strategic Plan with short-term and long-term outcome-related goals. 

DOD RESPONSE : Concur. DCAA has already started developing a revamped Strategic 
Plan with short-term and long-term outcome-related goals that is in concert with the 
proposed mission statement. Assuming the revised mission statement will be approved 
by about October 2009, DCAA is expected to complete its strategic plan by November 
30, 2009 for publication and dissemination to the DCAA workforce. 
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RECOMMENDATION 4 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to measure progress in achieving strategic goals, ensure that metrics tie to the revised 
mission statement and strategic plan and support the agency's annual work plan. 

POD RESPONSE : Concur. USD(C) will require DCAA to measure progress in 
achieving strategic goals. Once DCAA's revised mission statement and strategic plan are 
finalized, USD(C) will require DCAA to ensure that DCAA performance measures tie to 
the revised mission statement and strategic plan and support the Agency's annual work 
plan. 

RECOMMENDATION 5 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to consult with DoD stakeholders and engage outside experts to develop a risk-based 
contract audit approach that identifies resource requirements, and focuses on performing 
quality audits that meet generally accepted government auditing standards (GAGAS). 

DOD RESPONSE : Partially Concur. The majority of DCAA audits and other services 
are required by laws and regulations as outlined in the GAO draft report. DCAA already 
has a risk-based contract audit approach in identifying resource requirements. DCAA 
performs annual audit requirements planning procedures to establish staffing 
requirements based on its regulatory/statutory audit requirements and audit risk. An 
example of DCAA's risk-based audit approach for incurred cost audit requirements is 
DCAA's performance of desk reviews of the low risk contractor's incurred costs on a 
cyclical basis in lieu of performing a full incurred cost audit every year. Nevertheless, 
USD(C) will task DCAA to coordinate with the Under Secretary of Defense for 
Acquisition, Technology, and Logistics to assess DCAA audit requirements since any 
significant change in DCAA audit requirements would involve a change in acquisition 
policy. In addition, DCAA has engaged the Naval Post Graduate School to assist in its 
"cultural transformation." One of the projects is identifying and resolving differing 
stakeholder expectations while ensuring DCAA performs quality audits that meet 
GAGAS. DCAA's efforts will include consulting with DoD stakeholders and engaging 
outside experts as part of this project. The Department will complete its assessment by 
December 2010. 

RECOMMENDATION 6 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to establish an SES-level position with responsibility for audit quality assurance that 
requires demonstrated knowledge and experience in applying professional audit 
standards. 

DOD RESPONSE : Concur. In August 2008, DCAA established the position of 
Assistant Director, Integrity and Quality Assurance with responsibility for DCAA's 
quality assurance program. On July 9, 2009, this position was approved as an SES-level 
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position and the job announcement has been published. DCAA expects to fill this 
position by October 2009. 

RECOMMENDATION 7 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to establish a separate DCAA internal review organization to conduct critical internal 
inspector general functions, including performing periodic internal evaluations and 
reviews and addressing DCAA hotline complaints. 

POD RESPONSE : Concur. DCAA will establish a separate internal review 
organization to conduct critical internal inspector general functions, including performing 
periodic internal evaluations and reviews and addressing DCAA hotline complaints and 
serve as the Agency's ombudsman. The new organization will be established by 
December 2009. 

RECOMMENDATION 8 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to review DCAA's current portfolio of audit and nonaudit services to determine if any 
should be transferred, or reassigned to another DoD agency, or terminated in order for 
DCAA to comply with GAGAS integrity, objectivity, and independence requirements. 

DOD RESPONSE : Concur. USD(C) will require DCAA to assess its current portfolio 
of audit and nonaudit services to determine if any should be transferred, or reassigned to 
another DoD agency, or terminated in order for DCAA to comply with GAGAS integrity, 
objectivity, and independence requirements. DCAA will report the results of its 
assessment to USD(C) by March 2010. However, as stated above, the majority of DCAA 
audits and non-audit services are required by regulation or statute. As acknowledged by 
the GAO in its report, DCAA has already performed some of this assessment resulting in 
the elimination of DCAA auditor participation as members of Integrated Product Teams 
and Source Selection Evaluation Boards. 

RECOMMENDATION 9 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
based on the risk-based audit approach to develop a staffing plan that identifies auditor 
resource requirements as well as auditor skill levels and training needs. 

DOD RESPONSE : Concur. DCAA is entering into an agreement with the Army 
Management Support Agency to evaluate DCAA's requirements planning process and 
resulting staffing assessment for FY 2010. The Army will also provide an overall 
opinion on the sufficiency of DCAA staffing to provide audit coverage in line with its 
mission and strategic plan and fully comply with Generally Accepted Government 
Auditing Standards. In addition, DCAA has an internal education specialist to provide 
expert advice on DCAA training and an internal statistician to provide expert advice on 
statistical sampling audit techniques and training. 
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RECOMMENDATION 10 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to establish a position for an expert on auditing standards or consult with an outside 
expert on auditing standards to assist in revising contract audit policy, providing guidance 
on sampling and testing, and developing training on professional auditing standards. 

POD RESPONSE : Concur. The USD(C) will require DCAA to consult with an outside 
expert on auditing standards to assist in revising contract audit policy, providing guidance 
on sampling and testing, and developing training on professional auditing standards. 

RECOMMENDATION 1 1 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to revise DCAA audit policy to provide appropriate guidance on what constitutes 
sufficient testing to comply with GAGAS. Update DCAA's Contract Audit Manual, as 
appropriate. 

POD RESPONSE : Concur. USD(C) will require DCAA to issue audit policy on what 
constitutes sufficient testing to comply with GAGAS and update DCAA's Contract Audit 
Manual. DCAA will complete this action by December 2009. 

RECOMMENDATION 12 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to develop agency wide training on government audit standards. This training should 
emphasize the level of assurance intended by the various types of engagements and 
provide detailed guidance on auditor independence, planning, fraud risk, level of testing, 
supervision, auditor judgment, audit documentation, and reporting. 

POD RESPONSE : Concur. DCAA is currently developing a revised training course on 
Generally Accepted Government Auditing Standards. This course will emphasize the 
level of assurance intended by the various types of engagements and provide guidance on 
auditor independence, planning, fraud risk, level of testing, supervision, auditor 
judgment, audit documentation, and reporting. All PCAA employees have been notified 
that they will be required to take this course in FY 2010. PCAA is also increasing the 
level and complexity of GAGAS training in all courses. 

RECOMMENDATION 13 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to conduct a comprehensive, independent review of DCAA's revised audit quality 
assurance function. This review should focus on the consistent application of criteria 
used for assessing audit quality and assuring timely, consistent and appropriate reporting 
of review results. 

POD RESPONSE : Concur. On July 30, 2009, DCAA requested the DoDIG to perform 
its external quality review of DCAA's Quality Control System for audits and attestation 
engagements for the period ending September 30, 2009. 



Enclosure 1 
Page 4 of 5 



Page 121 



GAO-09-468 DCAA Audit Environment 



Appendix IV: Comments from the Department 
of Defense 



RECOMMENDATION 14 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to make appropriate recommendations to address annual quality assurance review 
findings of serious deficiencies and GAGAS noncompliance, provide training, and 
follow-up to assure that appropriate corrective actions have been taken. 

POD RESPONSE : Concur. The DCAA Integrity and Quality Assurance organization 
has already established a process for making recommendations to address annual quality 
assurance review findings of serious deficiencies and GAGAS noncompliance to the 
Director DCAA on a real-time basis. Based on these recommendations, DCAA will 
ensure that any necessary training is provided and appropriate corrective actions have 
been taken. 

RECOMMENDATION 15 : The GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defense (Comptroller/CFO) to require the Director of the DCAA 
to establish policies and procedures to ensure that auditors who make direct bill decisions 
are independent of management employees who review vouchers of contractors not 
eligible for the direct bill program, thereby reducing situations where DCAA auditors are 
encouraged to reduce their workload by approving contractors for the direct bill program. 

POD RESPONSE : Nonconcur. The Department believes that a review of the 
contractor's interim public vouchers is an integral function of DCAA's continual 
assessment of a contractor's billing system. A DCAA auditor who audits the contractor's 
billing system (and potential subsequent approval for direct bill) is in the best position to 
review and approve contract interim billings based on their thorough understanding of the 
contractor's system. In regards to the GAO concern that DCAA auditors may not report 
findings to reduce their workload by approving contractors for the direct bill program, the 
Department believes the GAO's concerns are mitigated based on the comprehensive 
supervisory and audit manager reviews. PCAA does not believe that the approval of 
interim vouchers along with the approval for contractors to be on direct bill results in a 
lack of auditor objectivity (see Enclosure 4, Comment 8). It should also be noted that 
since July 2008, the number of contractors on the direct bill program have been reduced 
by over 200 contractors and segments of many of the largest defense contractors have 
been removed from the direct bill program in FY 2009. In October 2008, DCAA issued 
clarifying guidance on contractor eligibility to participate in the direct bill program. This 
memorandum includes guidance on ensuring sufficient testing is performed when 
determining a contractor is eligible for direct bill. 
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GAO DRAFT REPORT DATED JULY 31, 2009 
GAO-09-468 (GAO CODE 195099) 



"DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM" 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO RECOMMENDATIONS FOR CONGRESSIONAL CONSIDERATION 

RECOMMENDATION 1 : In the short term, as DCAA makes progress in correcting 
fundamental weaknesses that have impacted audit quality, Congress could consider 
enhancing DCAA reform efforts by enacting legislation to grant it protections and 
authorities similar to those embodied in the Inspector General Act, as amended. 

POD RESPONSE : Nonconcur. DoD generally opposes providing DCAA with 
authorities similar to those contained in the Inspector General Act. DoD specifically 
opposes certain recommendations based on the IG model. We do not believe that the 
DCAA Director should be a Senate confirmed position unless DCAA is independent of 
DoD. Presidential nomination and Senate confirmation injects a political element into 
DCAA that is not appropriate and inevitably creates lengthy periods when there is no 
Director. We also oppose fixed terms for the DCAA Director. If DCAA remains part of 
DoD, the Secretary of Defense must have the ability to choose an appropriate Director. 
We also question the wisdom of an independent budget (which would prevent or limit our 
ability to move money into DCAA, as is occurring now based on funding from the 
Defense Acquisition Workforce Development Fund). Nor do we support mandatory 
public reporting, an additional burden on an agency that is already struggling to meet its 
many mission demands. 

While we do not support independence based on the IG model, we plan to take steps to 
strengthen DCAA's independence by establishing an appeals process that permits DCAA 
to seek resolution when there are differences of opinion as to the resolution of its audit 
findings. Under this process, DCAA could appeal differences first to the Director of 
Defense Procurement and Acquisition Policy (DPAP). If DCAA disagreed with the 
DPAP decision, DCAA would be permitted to appeal to the Under Secretaries of 
Acquisition, Technology, and Logistics and Comptroller, acting as a team. We expect 
that appeals at the Under Secretary level would be rare and would involve only the most 
important issues. 

RECOMMENDATION 2 : In the medium term, Congress could consider elevating the 
contract audit function within DOD by moving DCAA from under the DOD 
Comptroller/CFO and placing it under the Deputy Secretary of Defense. 

DOD RESPONSE : Nonconcur. DoD strongly opposes this recommendation. The 
Deputy Secretary is the Chief Management Officer of one of the world's largest 
organizations and backs up the Secretary in the wartime chain of command. The Deputy 
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simply does not have the time to provide oversight and support to individual defense 
agencies. 
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DC AA Actions Taken Since the Issuance of GAO Report GAO-08-857 

Structure 

• Approved Agency- wide reduction in supervisory span of control (June 2008). 

• Approved 25 new field audit offices and 5 new Regional Audit Managers lowering the 
span of control (May - February 2009). 

• Completed Agency-wide staffing assessment and requested staffing increase to 
Comptroller on September 10, 2008. Updates on staffing shortfalls were provided to the 
Comptroller at regular intervals throughout FY 2009. 

• Realigned Quality Assurance to report directly to the Deputy Director (August 2008) 

o Submitted request to OSD for SES level position for the Integrity and Quality 
Assurance (QA) function (September 2008). Request was initially denied by 
DoD in January 2009 and the position was filled at the GS-1 5 level. However, 
after another attempt by the Director for a SES position, DCAA received approval 
in July 2009 and a job announcement was issued shortly thereafter. 

o Expanded the next round of QA reviews. 

o Revised process for tracking and following-up on QA findings. 

o Revised process for next 3-year cycle to ensure all audit offices are covered, after 
consultation with the DoD IG. 

o Completed assessment on level of QA staffing. 

o Issued revised comprehensive instruction on DCAA's QA program (December 
2008). 

• Submitted request for funds under Section 852 acquisition workforce fund in December 
2008. Under the Defense Acquisition Workforce Development Fund, DCAA has 
received $17.2 million to date (allotments in March, April, and August). 

o DCAA brought on-board 245 new interns by the end of July and have many offers 
with on-board dates in late FY 2009. As a result, DCAA will easily meet the goal 
of 300 by the end of September and will probably exceed it. 

• Realigned all Financial Liaison Advisors from the Field Detachment region (region that 
handles all Top Secret audits) to Headquarters to avoid the appearance of a lack of 
independence. As of November 2008, all Financial Liaison Advisors report directly to 
Headquarters. 

• At the request of the Director, the DCAA point of contact for the Office of Special 
Counsel investigation was moved from the DCAA General Counsel to the DoD General 
Counsel's office due to the investigation being expanded. 

Culture 

• Revised policy for resolving differences in audit results and opinions - elevate within 
management structure from two to four levels (July 2008). 

• Ceased participation as members of Integrated Product Teams (IPTs) to avoid the 
appearance of a lack of independence (August 2008). 

• Revised performance measures - eliminated 1 8 measures and added 8 measures 
(September 2008). 
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• Established an anonymous website for employees to voice concerns with the 
inappropriate use of performance measures and other inappropriate actions (September 
2008). 

• Engaged OPM to conduct an organizational assessment survey and are assessing results 
of the survey conducted by OPM - the working group is evaluating results and 
developing actions (assessment due August 2009). 

• Ceased participation as members of Source Selection Evaluation Boards to avoid the 
appearance of a lack of independence - requested audits will still be provided (November 
2008). 

• Director/Deputy Director staff presentations emphasize the need to perform quality audits 
and discuss performance measures (various presentations through 2008 and 2009). 

• Established a Senior Advisory Council for Improvement chaired by the Director to 
oversee the implementation of improvements as a result of the Defense Business Board 
recommendations (report issued January 22, 2009). 

• Issued several memorandums reiterating the importance of cooperating with GAO, IG 
and other reviewers/investigators. 

• Held stand down day for audit quality at all DCAA locations (August /September 2008 
and again in August 2009). 

• Completed annual independence training (September 2008). 

• Held focus groups to obtain feedback on implementation of performance measures issued 
in September 2008 which revealed minimal problems with implementation of new 
measures (February/March 2009). 

• The Director required all regions to assess whether exceeding budget hours on individual 
assignments was inappropriately used to lower performance ratings. The regions 
completed the assessments and, where needed, have implemented corrective actions 
(December 2008). 

• Established new process to obtain input regarding the new hire employment experience 
and to identify reasons why employees leave DCAA (November 2008). 

• Revised job objectives/performance plans for the 051 1 (auditor) positions to eliminate the 
language on meeting audit budget hours and productivity measures and added language 
strengthening the need to execute audits in accordance with the auditing standards and 
Agency policy (February 2009). 

• Revised supervisory development curriculum based on feedback from focus groups and 
other feedback mechanisms to emphasize leadership skills and the more common day-to- 
day activities which supervisors perform (April 2009). 

Processes 

• Issued memorandum on adequate working paper documentation (July 2008). 

• Completed Agency-wide assessment to determine whether GAO's findings are systemic 
across DCAA. Six of the forty assignments reviewed contained noncompliances. 
Actions being taken to address issues (September 2008). 

• Raised the field audit office signature authority for all audit reports to the level of the 
manager or higher (August 2008). 
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• Revised policy for the monthly quality review of issued audit reports from regions to the 
Headquarters Quality Assurance division (October 2008). 

• Revised DCAA Quality Checklist for Review of Audit Working Papers (checklist is used 
by auditors and supervisors prior to report issuance) (December 2008). 

• Issued guidance clarifying DCAA's process for pursuing access to contractor records and 
initiating a subpoena (December 2008). 

• Issued clarifying guidance on what constitutes a significant deficiency in contractor 
internal control systems (December 2008). 

• Revised policy on reporting results of the review of contractor systems and related 
internal controls to eliminate the inadequate in-part opinion so that the overall opinion on 
the system is either adequate or inadequate (December 2008). 

• Issued guidance on performing and reporting on limited scope internal control audits 
(December 2008). 

• Issued guidance reminding auditors to report suspected contractor fraud and other 
irregularities encountered during the audit and emphasized that managers do not approve 
die Form 2000, but rather review it for clarity (February 2009). 

• Issued guidance on documentation of judgmental sampling (February 2009). 

• Revised guidance for reporting unsatisfactory conditions related to actions of 
Government officials wherein certain unsatisfactory conditions will be reported directly 
to the DoDIG in lieu of reporting the conditions to a higher level of management 
(March 2009). 

• Issued guidance clarifying requirements for contractor eligibility to participate in the 
direct bill program (April 2009). 

• Issued guidance to remove major contractors from direct billing where contractor has 
implemented a new billing system or accounting system that significantly impacts 
Government billings and the new system has not been examined (April 2009). 

• Revised a self-study training course (CMTL 1 326) to include new guidance on 
identifying key elements of an effective internal control audit report and the requirements 
for issuing a real-time (flash) report (May 2009). 

• Issued an audit alert emphasizing existing guidance which requires that a separate cost 
accounting standards (CAS) noncompliance audit report will be issued when a CAS 
noncompliance is found during any audit (June 2009). 

• Issued an audit alert to clarify that forward pricing due dates should be based on the 
realistic assessment of risk factors for each specific contractor and proposal under review 
(June 2009). 

• Issued guidance on contract audit closing statement reviews in July (after receipt of DoD 
IG comments). This completes the last action item from the peer review. 

Long-Term Planned Actions 

• Obtained the services of the Naval Postgraduate School, Center for Defense Management 
Reform to assist with the Agency-wide cultural transformation. The initial effort started 
June 2" with the DCAA executive team. As a result, four major initiatives were adopted 
for incorporation in the DCAA Strategic Plan. Teams of executives were assigned to 
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each initiative to further develop the milestone plan for executing the objective. The four 
items are: 

1 . How can DCAA put people first to guide its decisions, actions and values? For 
example, how can DCAA place an increased emphasis on "soft skills" such as 
building morale and developing employees (in terms of a broad understanding as well 
as technical proficiency)? 

2. How can DCAA develop leaders to serve the employees and the organization? 

3. How can DCAA structure the organization to facilitate compliance with GAGAS, 
maximize audit results/ROI, and better align Agency workload/resources? 

4. How can DCAA identify and resolve differing stakeholder expectations with 
contracting officers, contractors, the public (Congress), and external review 
organizations? 

These items will be worked for about the next three years. Once the milestone plan for 
each of the four initiatives is developed, it is envisioned that each objective will have 
various completed actions throughout the next three years. Once the milestone plans are 
developed, the objectives will be communicated to the workforce. 

• Performing a comprehensive assessment and revision to DCAA training by instituting a 
life-cycle training process. Effort started in FY 2008 and will conclude in about three 
years. 

• Conducting a comprehensive organizational assessment (based on Baldrige). Estimated 
completion in FY 2010. 

• Performing a comprehensive review of DC AA's approach for performing internal control 
audits. Estimated completion of baseline audit opinions in FY 2010. 

• Engaging the Army Force Management Support Agency to evaluate DCAA's process for 
planning FY 2010 audit needs as well as staffing requirements. The effort is expected to 
be completed by the end of September. 
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GAO DRAFT REPORT DATED JULY 3 1 , 2009 
GAO-09-468 (GAO CODE 195099) 



"DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM" 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO REPORT NARRATIVE 



See comment 1. 



1 ■ GAP NARRATIVE : Nationwide audit quality problems are rooted in DCAA's poor 
management environment (page 11). 

POD COMMENTS : GAO stated about half of the rescinded reports relate to unsupported 
opinions on contractor internal controls. This is incorrect. The majority of the rescinded reports 
relate to forward pricing reports based on the prior GAO investigation report issued in 2008. 

2. GAO NARRATIVE : Audit Quality Problems Found in All Audits GAO Reviewed, 
Independence Issues (page 12). 

POD COMMENTS : GAO stated that in 8 audits they reviewed, DCAA independence was 
compromised because auditors provided material nonaudit services to a contractor they later 
audited; experienced access to records problems that were not fully resolved; or significantly 
delayed report issuance in order to allow the contractors to resolve cited deficiencies. The 
Department understands the GAO's concerns, however, we believe the auditors' intent of 
providing preliminary audit results and discussing draft policies and procedures was generally an 
attempt to ensure the evidence was accurate and to expedite contractor actions so that contractor 
systems would be corrected promptly to minimize the risk of overpayments. DCAA 
acknowledges that significant time lapsed in several of these assignments between the time the 
contractor was provided the draft findings and the issuance of the final audit report. DCAA 
concurs that auditors should not provide input to contractors on draft policies and procedures and 
that the reports should identify all deficiencies found even though they have been corrected at the 
time of report issuance. In memorandums issued in August and September 2008, DCAA issued 
guidance prohibiting auditors from providing input to contractors on such items as draft 
proposals, draft policies and procedures, and draft disclosure statements and to require auditors 
to report all deficiencies found even when the contractor corrects the deficiencies during the 
audit. 



3. GAO NARRATIVE : Audit Quality Problems Found in All Audits GAO Reviewed, 
Insufficient Evidence (page 12). 

POD COMMENTS : GAO stated that 33 of the 37 internal control audits did not include 
sufficient testing to support auditor conclusions and opinions. GAO stated that GAGAS for 
examination-level attestation engagements require that sufficient evidence be obtained to provide 
a reasonable basis for the conclusion that is expressed in the report. We agree with GAO that in 
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See comment 2. 



See comment 3. 



See comment 4. 



several cases the testing was insufficient. The level of testing was based on the auditor's 
judgment and the total audit concept - drawing on an accumulation of knowledge and experience 
previously gained at the contractor based on auditing that contractor on a continual basis. 
Nevertheless, DCAA acknowledges the testing was insufficient to support an internal control 
audit opinion, and therefore, has rescinded several of these reports, increased the level of testing 
on related audits and commenced new full scope internal control audits at these locations. 

4. GAP NARRATIVE : Table 2, Summary of Five Selected Internal Control Audits, Eastern 
Region - Billing System Audit (page 16). 

POD COMMENTS : GAO stated that the subject audit had an impairment to auditor 
independence because the auditors helped the contractor develop policies and procedures. We 
generally concur with the GAO in that the FAO was performing IPT type effort in providing the 
contractor comments on draft policies and procedures. DCAA believes the intent of these 
actions was to expedite contractor corrective action so that the contractor's system would be 
corrected to minimize the risk of overpayments and protect the taxpayer's interests. DCAA 
recognized the potential appearance of a lack of independence related to this kind of effort and 
on August 1 1, 2008, issued audit guidance that prohibited auditors from providing input to 
contractors on such items as draft policies and procedures regardless of the circumstances. 

5. GAO NARRATIVE : Table 2, Summary of Five Selected Internal Control Audits, Central 
Region - Billing System Audit (page 1 6). 

POD COMMENTS : GAO stated that the subject audit had an impairment to auditor 
independence because the auditors monitored contractor corrective action for 7 months instead of 
issuing the audit report when the work was completed. DCAA concurs with the GAO that the 
significant lapse of time from the date the draft results were provided to the contractor and the 
date the audit report was issued gives the appearance of a lack of independence. However, the 
field audit office does not believe it intentionally delayed the issuance of the report to allow the 
contractor to correct the system. Staffing issues and an increase in higher risk assignments 
played a significant role in the delay. 

6. GAO NARRATIVE : Table 2, Summary of Five Selected Internal Control Audits, Central 
Region - Billing System Audit (page 16/17). 

POD COMMENTS : The GAO narrative appears to imply that DCAA was not aggressive in 
pursuing the potential fraud at this contractor. It should be noted that the DCAA Investigative 
Support Team was instrumental in assisting in this fraud investigation that resulted in recovering 
more than $2.8 million dollars in a civil case settlement. 

7. GAO NARRATIVE : Cost Related Assignments (page 17). 

POD COMMENTS : GAO stated that the 32 cost-related assignments did not contain sufficient 
testing to provide reasonable assurance that overpayments and billing errors that might have 
occurred were identified. It appears that the GAO is holding DCAA to the GAGAS 
requirements for these assignments even though the majority is not GAGAS-type audits based on 
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See page 76. 



Agency policy. DCAA does not agree that all of the 32 cost-related assignments contained 
insufficient testing, however, DCAA is continuing to assess the GAO's comments and will 
develop an appropriate action plan. 

8. GAP NARRATIVE : Auditor objectivity issues (page 20). 

POD COMMENTS : GAO stated that DCAA's role in approving contractors for participation in 
the direct bill program presented an impairment to auditor objectivity- which includes being 
independent in fact and appearance when providing audit and attestation engagements. The 
GAO noted that GAGAS state that audit organizations should not authorize an entity's 
transactions or audit their own work. GAO further stated that DCAA's role in authorizing 
contractors to participate in the direct bill program places it in the position of making decisions 
that impact its own workload related to review of contractor invoices prior to payment. 
Although not explicitly stated, the GAO seems to imply that when DCAA performs an audit of 
the contractor's billing system (and potentially approves the contractor for the direct bill 
program) while also having the responsibility for approving interim vouchers, DCAA is 
authorizing the contractor's transactions and it is auditing its own work. In addition, the GAO 
seems to imply that DCAA's objectivity is impaired and DCAA auditors may overlook findings 
to reduce their workload by approving contractors for the direct bill program. DCAA disagrees 
with both implications. 

DCAA is not authorizing a contractor's transaction or auditing its own work either when 
it approves the contractor for direct bill or approves an interim voucher for payment. GAGAS 
3.14 (GAO-03-673G) defines authorizing an entity's transactions as an example of performing 
management functions or making management decisions. When DCAA approves a contractor's 
voucher for payment it is not acting on behalf of the contractor (i.e., performing a contractor 
management function) but acting as a representative of the Government in its role as an 
independent external oversight organization based on the authority provided for in DFARS 
242.803. The contractor's interim vouchers submitted to the Government for payment are 
prepared by contractor employees and authorized by contractor management. 

DCAA also does not believe that performing the function of an external oversight 
organization by approving contractor's interim vouchers or approving the contractor for the 
direct bill program places DCAA in the position of auditing its own work when it later audits the 
contractor's billing system. These functions do not involve developing the contractor's billing 
system policies and procedures and internal controls. In addition, as stated above, DCAA also is 
not involved in preparing the contractor's vouchers. Therefore, approving contractor's interim 
vouchers or approving the contractor for the direct bill program and subsequently auditing the 
contractor's billing system does not result in DCAA auditing its own work. Furthermore, DCAA 
believes that its role in reviewing and approving interim vouchers falls within the category of 
nonaudit services discussed in GAGAS A3.02 and A3.03 (GAO-07-73 1G) that do not impair 
independence. 

We also disagree that DCAA's role in authorizing contractors to participate in the direct 
bill program results in an impairment to independence because performing that function places 
DCAA in the position of making decisions that impact its own workload. In our opinion the 
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GAGAS independence standards do not preclude the auditor from performing such functions. In 
fact, conclusions reached in many of the audits and other functions typically performed by 
auditors have the potential to impact the audit organization's workload. For example, a qualified 
or adverse opinion on the company's financial statements could prompt the company to replace 
the independent public accountant (IP A) that performed the audit; thereby negatively impacting 
the IPA's future workload and revenue. The GAO's concerns are mitigated by the fact that 
DCAA supervisors are actively involved in all aspects of the audit including review and approval 
of the risk assessment, interim reviews as needed, and a final comprehensive supervisory review 
of the working papers and draft report. Technical specialists may also review the risk assessment 
and audit conclusion. In addition, field audit office managers review sensitive and high risk 
audits and may elevate them for regional management review prior to report issuance. 

GAO stated that DCAA had approved direct billing on all but 2 of the 16 contractors they 
reviewed. GAO reviewed 20 billing system audits covering 17 contractors, only 2 of those 
contractors are still on direct billing. It should also be noted that since July 2008, the number of 
contractors on the direct bill program have been reduced by over 200 contractors. 

9. GAO NARRATIVE : DCAA's audit quality assurance program was ineffective (page 25). 



See page 78. 



POD COMMENTS : GAO stated that DCAA's audit quality assurance program was not 
properly implemented, resulting in an ineffective quality control process that accepted audits 
with significant deficiencies and noncompliance with GAGAS and DCAA policy. We do not 
agree with the statement that the quality assurance process accepted audits with significant 
deficiencies. As the GAO states in its report, the quality assurance reviews did identify 
significant GAGAS noncompliances which they reported to the field audit office for corrective 
action - they did not "accept" these audits. DCAA has recently made several improvements to 
the quality assurance program to include increasing the level of management responsible for 
developing and implementing a corrective action plan. The current program requires the 
Regional Director to ensure corrective actions have been taken and all corrective actions will be 
tested by the Headquarters quality assurance staff to ensure the noncompliances have been 
corrected. 



See page 75. 



10. GAP NARRATIVE : DCAA lacks a risk-based audit planning approach (page 28). 

POD COMMENTS : GAO stated that DCAA lacks a risk-based audit planning approach. We 
do not agree with this statement. DCAA has a risk-based contract audit approach in identifying 
resource requirements. DCAA performs annual audit requirements planning procedures to 
establish staffing requirements based on its regulatory/statutory audit requirements and audit 
risk. 



1 1 . GAO NARRATIVE : Allegations about abusive management actions have continued (page 
32). 



POD COMMENTS : The GAO states that allegations about abusive management actions have 
continued. The report further states that "PCAA Headquarters officials explained that in several 
cases, Western Region management has not agreed to take disciplinary or other available 
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See comment 5. 



See comment 6. 



See comment 3. 



corrective action. The officials told us that DCAA hotline staff has no recourse in these 
situations." The DCAA hotline group functions as a finder of fact, and they recommend 
corrective actions. While it is true that the DCAA hotline group has no authority to take 
disciplinary action itself or to require corrective action, any disagreement between the hotline 
team and the region may be resolved by the DCAA Director or Deputy Director. The Western 
Region management has agreed with the recommended actions provided by the hotline team in a 
final formal report. Several cases are still in the investigative stage and although interim 
recommendations may not have been adopted yet by the region, we fully expect the Western 
Region management to support the recommendations made in a final report. 

12. GAP NARRATIVE: Increase authority and independence (Page 50). 

POD COMMENTS : GAO stated that legislation could strengthen DCAA's audit authority by 
providing the same level of access to records and personnel available to IGs. GAO goes on to 
state that currently, DCAA has access to certain records related to cost-type contracts or that 
contain cost and pricing data, but not to contractor personnel. We do not agree with the 
statement that DCAA does not have access to contractor personnel. DCAA interfaces with 
contractor employees during all phases of the audit, which include interviews, inquiry, 
observation as well as providing draft audit results for comment and verification of factual 
content. 

13. GAO NARRATIVE : Independence Impairments, (Pages 60-61). 

POD COMMENTS : The GAO provides an example in this narrative section where the GAO 
contends that the field audit office experienced an access to records issue. The GAO concludes 
that since the contractor inquired regarding the auditor's need for certain data, there was an 
access to records issue. DCAA routinely encounters "push back" from contractors, this does not 
constitute an access to records impairment if the auditor does not succumb to the pressure and 
obtains the requested data. The field audit office does not believe its access to data relating to 
the training records was denied by the contractor as cited by the GAO. The contractor 
subsequently provided the requested data to the auditor. 

14. GAO NARRATIVE : Failure to Design and Perform Procedures to Detect Fraud Risk 
(Pages 64-66). 

POD COMMENTS : The GAO provides an example in this narrative section where the GAO 
contends the FAO manager and supervisor ordered an auditor to ignore significant fraud risks 
during the audit. PCAA does not agree with this conclusion and has not been provided evidence 
to support this assertion. It should be noted that the DCAA was instrumental in assisting in this 
fraud investigation that resulted in recovering more than $2.8 million dollars in a civil case 
settlement. 
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Defense Procurement and Acquisition Policy (DPAP) 
Collateral Action Officer's Comments on GAO Draft Report: 
"DCAA Audits: Widespread Problems With Audit Quality Require Significant Reform ' 



Following are the DPAP's Collateral Action Officer's (CAO's) technical 
comments regarding the Government Accountability Office's (GAO's) July 31, 2009 
Draft Report GAO-09-468 (GAO Code 195099) "DCAA Audits: Widespread Problems 
With Audit Quality Require Significant Reform". 



1. Auditing in the Public Interest 



See page 78. 



The report, in part, impugns DCAA's audits stating, "DCAA's management 
environment ...put DCAA in the role of facilitating DoD contracting without also 
protecting the public interest." 1 Likewise, the GAO mentions that the "DCAA mission 
should be refocused to protect the taxpayer interest ..." compared to the current mission 



that "fostered the culture of supporting contracting officials . 



As a result, the GAO 



agrees with the Defense Business Board's recommendation to "revise DCAA's mission to 
focus on protecting the interest of taxpayers, with the taxpayer as the primary customer 

„3 



The report adopts a position that because DCAA is serving the interests of 
Contracting Officers, that DCAA is not auditing in the interest of the public. DCAA is a 
service organization created to provide financial information, audits, and advice to 
support decision making by DoD Contracting Officers. DCAA serves the public interest 
by providing timely and useful information to Contracting Officers. It is erroneous to 
imply that contracting officers do not seek to protect the public interest. 

The contracting officer is bound by regulation to meet the public interest in the 
broadest sense, for the entire matter surrounding a contract. The contracting officer, in 
the award and administration of a contract, is the government official responsible for 
insuring that all requirements of law, executive orders, regulations, and all other 
applicable procedures, including clearances and approvals, have been met. Any logic that 
presumes that by focusing on supporting contracting officials DCAA somehow failed to 
act in the public interest is flawed in our view. Someone trained and named in both law 
and regulation has to look at the larger picture, and not just the audit, if the public interest 
is to be served — the contracting officer is that person. 

Numerous provisions of the Federal Acquisition Regulations (FAR), for instance, 
speak to the issue of all members of the acquisition and administration community 
serving the public interest: 



1 Executive Summary 

2 Page 34 
J IBID 
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An essential consideration in every aspect of the System is maintaining the 
public's trust. Not only must the System have integrity, but the actions of 
each member of the Team must reflect integrity, fairness, and openness. 
The foundation of integrity within the System is a competent, experienced, 
and well-trained, professional workforce. Accordingly, each member of 
the Team is responsible and accountable for the wise use of public 
resources as well as acting in a manner which maintains the public 's 
trust. Fairness and openness require open communication among team 
members, internal and external customers, and the public. 4 



Specifically to contracting officers, FAR states: 

Contracting officers are responsible for ensuring performance of all 
necessary actions for effective contracting, ensuring compliance with the 
terms of the contract, and safeguarding the interests of the United Stales in 
its contractual relationships. In order to perform these responsibilities, 
contracting officers should be allowed wide latitude to exercise business 
judgment. 5 

By serving the interests of Contracting Officers well, DCAA does serve the public 
interest. It is not one or the other as might be interpreted in the report. 



See comment 7. 



2. Production Auditing 

Throughout the report, the GAO implies and in some instances states that the 
problem is "Production-Oriented Auditing" and that audits have been rushed by 
contracting officer requirements. This sets up a dichotomy between "quality" audits and 
timely audits. We strongly urge the GAO to consider that an audit not delivered in time 
to be useful, is of limited value to the Government. 

For example, a proposal review delivered after negotiation has started and 
decisions have already been made is of greatly diminished usefulness. Likewise, an 
incurred cost review that is not completed in a reasonable period after the costs are 
incurred loses contemporaneous support — employees of the contractor and the 
Government leave, some records are lost or are placed in deep storage. Similarly, 
business system reviews need to be issued while a problem is still subject to correction 
before the fact to protect the Government's interests, not two and three years later. 

Timeliness is a critical element of quality. Delays in award have consequences to 
the warfighter. Contracting officers are required to consider those consequences and 
hence, they are very concerned that DCAA has not been able to consistently deliver 



4 FAR 1.102-2 (c)(1) Performance standards. 

5 FAR 1.602-2 Responsibilities 
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timely reports and advice. The GAO has previously recognized there are consequences to 
award delays: 6 



See comment 8. 



"Although federal regulations do not specify how long the contract award 
process should take, the regulations state that the purpose of planning the 
contract award process is to ensure that the government obtains the needed 
goods or services in the most effective, economical, and timely manner. 
Therefore, written plans for carrying out the award process must include 
milestones for completing the steps in the process, such as when the agency 
plans to solicit and evaluate proposals and make the award. Developing and 
adhering to these schedules can help ensure that the department conducts 
the process efficiently and can help companies make informed business 
decisions regarding the allocation of their resources and whether to 
compete for a contract." 

"Delays in awarding contracts could increase costs... and could also affect 
the willingness of companies to compete for future... contracts.... 
Specifically, in addition to investing time and resources in developing 
proposals, once a company submits a proposal . . .the company is generally 
required to ensure that the key personnel identified in the proposal 
continue to be available until the decision is made and the contract 
awarded. . . .Increased costs and the length of time it takes. . .to award a 
contract also have the potential to affect competition for future. . . work." 

GAO's recognition of this fact in the aforementioned report, while important, is 
still a comparatively limited view of timeliness compared to a contracting officer's point 
of view. A contracting officer knows that delays can impact funding decisions and 
disrupt program management plans. Contracts are often interrelated and codependent, 
such that a delay in awarding one contract can delay an entire system and put off fielding 
dates, with consequences distributed and cascading through a range of other contracts and 
plans, and might ultimately result in mission failure. The contracting officer, also by 
regulation, has to consider and respect the opinions of other specialists that he works 
with, and not just that of the auditor. A good audit in time is better than an extraordinary 
audit that is late and never used. An audit is a tool the contracting officer uses to 
negotiate and administer a contract, but in order to realize the benefits of the auditor's 
work, the audit must be timely. 

3. Generally Accepted Government Auditing Standards (GAGAS) 

As the GAO correctly points out, DCAA performs most of its audits and reviews 
in conformance with GAGAS. We believe that for some reviews and financial advice 
provided by DCAA, it is possible that it may not be necessary to provide a fully 
conforming GAGAS audit report to support certain contracting officer functions (e.g., 



GAO-06-722, DOE CONTRACTING, Better Performance Measures and Management Needed to Address 
Delays in Awarding Contracts, June 30, 2006 
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providing an attestation review rather than a financial audit). DCAA should use auditing 
standards and techniques that produce creditable information that can be relied upon by 
the contracting community in the awarding and administrating of contracts. However, we 
believe that all types of DCAA reports and reviews should be examined to determine if 
the standard being applied and reported by DCAA is the appropriate standard given the 
requirement causing the audit or review to be performed. 



See comment 9. 



See page 74. 



4. Staffing 

While the report cites examples of poor quality audits and some poor decisions 
made by DCAA management, most would seem to be heavily influenced by lack of 
adequate staffing. Based on our discussions with contracting officers, contractors, and 
auditors, some and possibly most of the reductions in audit scope and responsiveness by 
DCAA is a direct result of the staffing drawdown while workload increased. Until the 
staffing issues are resolved, it will not be possible for DCAA to perform at the level of 
quality and efficiency that is desired. Rebuilding the DCAA workforce, while a challenge, 
can and must be done. The workforce build-up will require years of effort to hire and train 
the staff required to do the work envisioned by the GAO audit. 

5. Placement of DCAA in the Executive Branch 

The report raises the question of DCAA's placement within DoD or the Executive 
Branch. Currently DCAA performs most of the contract auditing functions within the 
Executive Branch. Even if DCAA performed the remaining contract audits it currently is 
not performing, DoD would remain by a large factor the majority user of the DCAA 
services. We do not believe that any useful purpose would be served by moving DCAA 
outside DoD. DoD has the most vested interests in a well functioning DCAA. 



In our view, in reporting to the Comptroller, DCAA is insulated from direct 
influence from contract procurement and contract administration offices. For similar 
reasons DCMA is in the AT&L chain of command to insulate it from pressures it might 
have placed on it, if it were in the same chain of command as the procurement offices. 
The Comptroller is in the best position to understand the DCAA requirements while 
maintaining its independence from the audit report users. 



See page 75. 



6. Risk Based Auditing 

According to the DCAA Contract Audit Manual 7 , all audit planning is risk based. 
This applies to both the annual planning for types of audits and staff requirements as well 
as for the planning of specific audits. The Audit Manual is quite clear that the final 
budget set for the assignment is to be based on the circumstances and risk attached to the 
assignment being planned. Further, it also clearly sets out that as circumstances change 
or the risk is found to be different than considered during the planning stage, that budget 
changes should be made. 



'Chapter 3, Section 100 
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We are faced in the GAO report with the finding that budgeted hours do not 
reflect the risk and that changed risk found during the field work has not resulted in 
changed budgets. This is obviously not a policy matter of DCAA not doing risk-based 
auditing, since the findings are clearly at odds with the DCAA policy. We believe that 
the failure to follow the policy is a result of staffing constraints that made it impossible 
for DCAA to perform all the assigned review requirements to the standards expected. 



See page 76. 



7. Direct Billing 

This GAO draft report seems to misunderstand the Direct Billing program and the 
problems noted in DCAA administration of voucher reviews. Direct Billing approval was 
not designed to reduce review of vouchers. It was designed to administratively take 
advantage of technology to better process vouchers in an efficient manner and to better 
comply with the Prompt Payment Act. In appropriate circumstances using risk-based 
analysis of contractor past performance and the quality of its business systems, contractors 
were to be allowed to be paid before review of vouchers instead of requiring review of the 
vouchers before payment. 

The nature of the review program for any given contractor should not have 
changed due to placement on Direct Billing. The DCAA guidance requires voucher 
reviews of all contractors every year that the contractor has Direct Billing authority. 
Where DCAA believed based on past performance or poor systems that there was a 
significant chance of improper billing, the contractor was not to be included in the Direct 
Billing program. The review program for the contractors should have been the same as it 
would have been based on risk factors even if there was no Direct Billing program. 



The problem with voucher reviews both before the Direct Billing program and 
after the initiation of the program is that DCAA did not have sufficient staff to perform 
the reviews required by the risk-based analysis. New contractors and problem contractors 
should have voucher reviews before payment just as required by DCAA policy. 
Established contractors with adequate past performance should have vouchers reviewed 
after payment using a reasonable plan tailored to the contractor's circumstances just as 
required by DCAA guidance. Changing the decision authority for participation in Direct 
Billing should have no impact on what vouchers are reviewed. Taking a contractor off of 
the program does not ensure that the vouchers will be properly reviewed prior to payment 
if there is not sufficient staff to perform the reviews. 



Enclosure 5 
Page 5 of 5 
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The following are GAO's comments on the U.S. Department of Defense 
letter dated September 4, 2009. 



q A q QojjijjigjYkg Rescinded reports. DOD stated that we were incorrect in stating that 

about half of the rescinded reports relate to unsupported internal control 
reports. DOD is correct. Of the 80 rescinded audit reports, 24 (31 percent) 
relate to unsupported opinions on contractor internal controls, 47 (61 
percent) relate to forward pricing reports, and 6 (8 percent) relate to 
defective pricing, compliance with cost accounting standards, and a labor 
floor check. We have corrected this information in the body of our report. 

2. Central Region billing system audit. DOD stated that the DCAA field 
audit office does not believe that it intentionally delayed issuance of the 
report to allow the contractor to correct the system. Audit documentation 
clearly shows that the auditors monitored the contractor's actions for 7 
months and issued the audit report 9 months after the exit conference, 
once the contractor had prepared "written desk procedures to ensure 
liquidation progress billings would be handled correctly." Opinions should 
be based on the findings at the end of the audit, and reports should be 
issued when the audit is completed. 

3. Central Region billing system audit during fraud investigation. 

DOD stated that our report appears to imply that DCAA was not aggressive 
in pursuing the potential fraud at this contractor and noted that the DCAA 
Investigative Support Team was instrumental in assisting in the fraud 
investigation that recovered over $2.8 million in a civil case settlement. 
The audit documentation shows that the Regional Audit Manager, in the 
presence of the field office manager and the supervisory auditor, directed 
the auditor not to pursue contractor charges of costs to future-year, 
unfunded contract lines and to forget what she learned in her previous 
DOD contract administration job where she had been responsible for 
reviewing similar types of contracts. In addition, after reassignment of the 
first supervisor, the second supervisory auditor instructed the auditor to 
stop "over documenting" her audit, to complete the assignment, and issue 
the report. Moreover, the DCAA auditors who investigated the fraud 
worked with the Army Criminal Investigative Division special agent and 
Department of Justice Attorneys, not the DCAA field audit office. Finally, 
we did, in fact, discuss additional documentation we received from the 
investigative auditors with DCAA headquarters officials and provided 
them a summary of the key audit-related issues that we obtained from the 
investigators. 
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4. Insufficient testing in cost-related assignments. DOD stated that it 
appears that GAO is holding DCAA to the GAGAS requirements for these 
assignments even though the majority of these audits are not GAGAS-type 
audits. As discussed in our report, DCAA does not consider its paid 
voucher reviews and overpayment assignments to be GAGAS assignments. 
However, this is important work intended to assure the reliability of 
contract payments. Specifically, DCAA paid voucher reviews are relied on 
for making billions of dollars in continuing contract payments without 
prior review by the government. The Defense Finance and Accounting 
Service (DFAS) relies on DCAA voucher reviews, and DFAS certifying 
officers do not repeat review procedures they believe were performed by 
DCAA. Because paid voucher reviews constitute a payment audit, they 
require sufficient testing to support reported DCAA conclusions that the 
government can rely on contractor controls over preparation of interim 
vouchers to continue to make contract payments without prior review. In 
addition, DCAA's overpayment audits are intended to determine whether 
the contractor has adequate controls in place to detect and correct causes 
of overpayments and billing errors and make timely refunds and 
adjustments. The limited testing we observed in our work does not 
provide the intended assurance. 

5. Increase authority and independence. DOD stated that it did not 
agree with our statement that DCAA does not have access to contractor 
personnel. The discussion in our report is based on DCAA's authority in 10 
U.S.C. 2313(a)(B)(2), which gives DCAA legal access to certain contractor 
records but not access to contractor personnel. Further, DCAA subpoena 
authority in 10 U.S.C. 2313(b) is specific to the production of contractor 
records that DCAA is authorized to audit or examine and does not cover 
contractor personnel. We agree that in practice, DCAA auditors have 
numerous ongoing discussions with contractor personnel. However, if a 
contractor official refuses to talk to an auditor, DCAA does not have legal 
authority to compel contractor officials to meet with or talk to DCAA 
auditors. Our point is that under authority similar to the IG Act, DCAA's 
authority to interview contractor officials would be enhanced. 

6. Independence impairments. DOD stated that DCAA routinely 
encounters "push back" from contractors and that the DCAA field office 
subsequently received training records from the contractor. We recognize 
that the field office received some training records from the contractor. 
However, we saw a pattern throughout this audit where the auditor limited 
requests for contractor documentation and also performed little or no 
testing in various areas because "the contractor would not appreciate it" if 
he did more testing. The audit documentation shows that the auditor 
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performed limited testing of selected billing clerk training. Additionally, 
documentation on testing of the contractor's review of subcontractor 
costs shows that although the auditor should have tested cost data for 
three of the top five subcontractors, the auditor asked the contractor to 
"provide a list of the top 3-5 subcontracts, including subcontract values.... 
Three subcontractors would be fine." This indicates that the auditor not 
only accepted data the contractor was willing to provide for testing, but he 
also let the contractor select the data to be used for testing. The auditor 
then tested costs of only one subcontractor. The pattern of backing off on 
requests for documentation and limiting the extent of testing based on 
concerns about the contractor's reaction indicates that the auditor was 
influenced by the contractor and limited his audit procedures as a result — 
a clear independence impairment. DCAA rescinded the audit report on 
February 10, 2009. 

7. Production auditing. USD AT&L comments suggest that there is a 
trade-off between audit timeliness and audit quality. We view both quality 
and timeliness as critical to effective contracting officer decision making. 
However, timely audits that do not meet professional standards are not 
quality audits and could be misleading or impair important contract 
decisions. For example, our audit identified three contractor internal 
control audits — an accounting system audit and two billing system 
audits — that were completed in 9, 13, and 15 days, respectively — all with 
adequate opinions on the contractor's internal controls. Apparently, the 
contracting officers involved thought these audits were timely and met 
their needs because there was no audit documentation to the contrary. 
However, in response to our work, DCAA has rescinded all three of these 
audits. USD AT&L comments also stated, "A good audit in time is better 
than an extraordinary audit that is late and never used." Our report did not 
call for extraordinary audits. DOD has determined that certain DCAA 
audits should comply with professional standards. When audit 
organizations state that their audits comply with professional standards, 
they must follow these standards. Further, until DCAA and AT&L address 
the need for DCAA to perform 30,000 assignments and issue over 20,000 
reports annually, DCAA will continue to face audit quality and timeliness 
problems. 

8. Contract audits in conformance with GAGAS. USD AT&L states 
that it believes that for some reviews and financial advice provided by 
DCAA, it is possible that it may not be necessary to perform GAGAS work 
to support certain contracting officer functions. We agree. As discussed in 
our report, a risk-based audit approach may require an appropriate 
delegation of nonaudit contract administration activities and audit 
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responsibilities among DCMA, buying commands, finance community, and 
DCAA. An effective risk-based approach would include an effort by these 
communities to re-evaluate whether all such services should be provided 
as audits and whether DCAA, as an independent audit organization, would 
perform any nonaudit services. 

USD AT&L also stated that DCAA may be able to support contracting 
officer functions through an attestation review rather than a financial 
audit. However, DCAA does not perform financial audits. Instead, DCAA 
performs examination-level attestation audits and reports conclusions and 
opinions on subject matter as a whole. Examinations provide the highest 
level of assurance, and they must be based on sufficient evidence, often 
referred to as positive assurance work. For an attestation review, GAGAS 
require auditors to perform sufficient testing to form a conclusion based 
on the work performed. It is important to note that GAGAS prohibit 
auditors from performing review-level attestation work for reporting on 
internal control or compliance with laws and regulations. 

9. DCAA staffing. USD AT&L stated that "the [DCAA] workforce build-up 
will require years of effort to hire and train the staff required to do the 
work envisioned by the GAO audit." We did not call for a build-up of the 
DCAA workforce. Instead, we noted that DCAA production metrics had a 
direct impact on audit quality. Therefore, it will be important to perform a 
risk-based analysis of FAR requirements and determine the mix of audit 
and nonaudit services that will best meet these requirements with 
consideration of appropriate roles and responsibilities of the contracting 
and finance communities. 
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INSPECTOR GENERAL 

DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, VIRGINIA 22202-4704 

SEP 3 2009 
Gregory D. Kutz 
Managing Director 

Forensic Audits and Special Investigations 
Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Re: GAO Draft Report, "DCAA AUDITS: Widespread Problems with Audit Quality 
Require Significant Reform," dated July 31, 2009 (GAO Code 195099/GAO-09-468) 

Dear Mr. Kutz: 

Thank you for the opportunity to respond to the subject draft report. We recognize the 
critical role that the Defense Contract Audit Agency (DCAA) plays in contractor oversight 
inside and outside the Department of Defense, and we take very seriously concerns about 
compliance with generally accepted government auditing standards (GAGAS) by DoD audit 
organizations. 

Our narrative response to your recommendations are included at Enclosure 1. As an 
alternative to the recommendation that this office rescind or modify our May 2007 External 
Review of the DCAA Quality Control System opinion report, we instead notified DCAA on 
August 24, 2009, that our May 2007 "adequate" opinion on the DCAA system of quality 
control would expire on August 26, 2009 (See Enclosure 2). On the basis of our action, 
DCAA has begun to qualify its GAGAS-compliant audits with a statement noting an 
exception to compliance with the Quality Control and Assurance Standard. In addition, it 
was recommended that DCAA publicly disclose the concerns of your office to include 
questioning the reliability of audit reports issued during the period covered by our May 2007 
opinion. Our August 24, 2009, memorandum to the DCAA will be made public upon the 
release of your report. 

Please contact Ms. Carolyn R. Davis at (703) 604-8877 if you have any questions. 

Sincerely, 

Gordon S. Heddell 

Enclosures: 
As stated 
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GAO DRAFT REPORT DATED JULY 31, 2009 
GAO-09-468 (GAO CODE 195099) 



"DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY REQUIRE 

SIGNIFICANT REFORM" 

DEPARTMENT OF DEFENSE INSPECTOR GENERAL COMMENTS 
TO THE GAO RECOMMENDATIONS 



RECOMMENDATION 1 : The GAO recommends that the Department of Defense 
Inspector General (DoD IG) reconsider its overall conclusions in the May 2007 DoD IG 
report on the audit of DCAA' s quality control system in which it reported an adequate 
("clean") opinion on DCAA system of quality control in light of the serious deficiencies 
and findings included in that report and the additional evidence identified in our audit. 
(Page 57/GAO Draft Report) 

DODIG RESPONSE : Concur. 

RECOMMENDATION 2 : The GAO recommends that the Department of Defense 
Inspector General based on the above, determine whether the report should be rescinded 
or modified. (Page 57/GAO Draft Report) 

DODIG RESPONSE : Nonconcur. In reference to your recommendation that we 
rescind or modify our May 2007 External Review of the DCAA Quality Control System 
opinion report, we have taken an alternative action that conforms to the intent of your 
recommendations. The DoD IG has taken the extraordinary action of notifying DCAA 
that our "adequate" opinion on DCAA's system of quality control as detailed in the 
May 2007 External Review of the Defense Contract Audit Agency (DCAA) Quality 
Control System report will expire as of August 26, 2009 (See Enclosure 2). 

Our action recognizes that our May 2007 report was based upon a quality review 
methodology that differed substantially from your audit, but acknowledges that additional 
concerns about DCAA quality controls must be addressed. On August 5, 2009, we 
announced a project under the title "Evaluation of the Defense Contract Audit Agency 
Quality Assurance Program" (Project No. D2009-DIP0AC-0283). The results of this 
evaluation will be used in formulating our next opinion on the DCAA external quality 
control system for the period ending September 30, 2009. The overall opinion will take 



Enclosure 1 
Page 1 of 2 
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into consideration repeated non-compliances with Government Auditing Standards 
identified in our May 2007 and December 2003 opinion reports on the DCAA quality 
control system. By not rescinding our May 2007 report, we can also use the repeat 
deficiencies in formulating our next opinion. 

Placing an expiration date on the opinion means that after August 26, 2009, DCAA 
will be operating without an opinion on its system of quality control. We have 
recommended to the Director, DCAA, that her agency immediately begin to qualify its 
GAGAS-compliant audits with a modified GAGAS statement noting an exception to 
compliance with the Quality Control and Assurance Standard. Additionally, we have 
recommended that DCAA publicly disclose on its official website your concerns, 
including the questioning of the reliability of audit reports issued during the period 
covered by this office's May 2007 opinion. 

Our May 2007 report and the GAO July 2009 draft report focused on the period 
ended September 30, 2006. I believe it is paramount that we move forward and critically 
analyze the existing DCAA environment, its organizational effectiveness, and the quality 
of its recent audit work. Given the critical mission of DCAA, we plan to focus our 
attention and resources on a current analysis to yield real-time effective recommendations 
to improve DCAA audit quality. 



Enclosure 1 
Page 2 of 2 
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INSPECTOR GENERAL 
DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, VIRGINIA 22202-4704 



AUG 2 4 2009 



MEMORANDUM FOR DIRECTOR, DEFENSE CONTRACT AUDIT AGENCY 

SUBJECT: Review of the Defense Contract Audit Agency Quality Control System (OIG 
Report No. D-2007-6-006) and GAO Draft Report, "DCAA Audits: 
Widespread Problems with Audit Quality Require Significant Reform" 
(GAO-09-468) 

Our May 2007 External Review of the Defense Contract Audit Agency (DCAA) 
Quality Control System provided DCAA with an adequate opinion on its internal quality 
control system while still identifying significant audit quality problems. However, our - 
significant findings in 2007 coupled with the results of the July 2009 Government 
Accountability Office (GAO) draft report, "DCAA Audits: Widespread Problems with 
Audit Quality Require Significant Reform" (GAO-09-468), necessitates that we take 
further action. We have determined that it is not prudent to allow the adequate opinion 
from our May 2007 report to carry forward. Therefore, effective August 26, 2009, our 
adequate opinion will no longer apply to the DCAA system of quality control and will 
require further actions on your part. Specifically, we recommend the following be 
implemented immediately: 

1 . After August 26, 2009, all DCAA audits identified as being in compliance with 
generally accepted government auditing standards (GAGAS) must be qualified 
with a modified GAGAS statement noting an exception to compliance with the 
Quality Control and Assurance standard. 

2. DCAA should publicly disclose on the DCAA website GAO's concerns regarding 
the reliability of DCAA audit reports issued during the period covered by this 
office's May 2007 opinion. 

As requested by your July 30, 2009, letter to my office, we have started preparing 
for the external quality control review ("peer review") of DCAA for the period ending 
September 30, 2009. On August 5, 2009, we announced that project under the title 
"Evaluation of the Defense Contract Audit Agency Quality Assurance Program" (Project 
No. D2009-D1POAC-0283.000). The results of this evaluation will be used in 
formulating our overall opinion of the DCAA quality control system. The overall 
opinion will also take into consideration repeated non-compliances with Government 
Auditing Standards identified in our May 2007 and December 2003 opinion reports on 
the DCAA quality control system. 

Enclosure 2 
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This action is necessary to maintain the integrity of this office's oversight 
responsibilities for audits conducted by Department of Defense agencies. This 
memorandum is being distributed to the recipients of our May 1, 2007, opinion report, 
and will be posted with the May 2007 opinion report on our DoDIG website. 

Please contact me or Mr. Charles W. Beardall at (703) 602-1017 or 
Ms. Carolyn R. Davis at (703) 604-8877 if you have any questions. 



Gordon S. Heddell 



cc: Under Secretary of Defense 

(Comptroller)/Chief Financial Officer 



Enclosure 2 
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Obtaining Copies of 
GAO Reports and 
Testimony 



The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 
is through GAO's Web site (www.gao.gov). Each weekday afternoon, GAO 
posts on its Web site newly released reports, testimony, and 
correspondence. To have GAO e-mail you a list of newly posted products, 
go to www.gao.gov and select "E-mail Updates." 
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Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional information. 
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E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 
U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, DC 20548 
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